diff --git a/assets/epinio-crd/epinio-crd-102.0.4+up1.9.0.tgz b/assets/epinio-crd/epinio-crd-102.0.4+up1.9.0.tgz new file mode 100644 index 000000000..a2678b650 Binary files /dev/null and b/assets/epinio-crd/epinio-crd-102.0.4+up1.9.0.tgz differ diff --git a/assets/epinio/epinio-102.0.4+up1.9.0.tgz b/assets/epinio/epinio-102.0.4+up1.9.0.tgz new file mode 100644 index 000000000..ec2ae5ea0 Binary files /dev/null and b/assets/epinio/epinio-102.0.4+up1.9.0.tgz differ diff --git a/assets/fleet-agent/fleet-agent-102.2.0+up0.8.0.tgz b/assets/fleet-agent/fleet-agent-102.2.0+up0.8.0.tgz new file mode 100644 index 000000000..fdadb1fd0 Binary files /dev/null and b/assets/fleet-agent/fleet-agent-102.2.0+up0.8.0.tgz differ diff --git a/assets/fleet-crd/fleet-crd-102.2.0+up0.8.0.tgz b/assets/fleet-crd/fleet-crd-102.2.0+up0.8.0.tgz new file mode 100644 index 000000000..0e5c7f6a2 Binary files /dev/null and b/assets/fleet-crd/fleet-crd-102.2.0+up0.8.0.tgz differ diff --git a/assets/fleet/fleet-102.2.0+up0.8.0.tgz b/assets/fleet/fleet-102.2.0+up0.8.0.tgz new file mode 100644 index 000000000..46476875f Binary files /dev/null and b/assets/fleet/fleet-102.2.0+up0.8.0.tgz differ diff --git a/assets/prometheus-federator/prometheus-federator-0.3.0+up0.3.3.tgz b/assets/prometheus-federator/prometheus-federator-0.3.0+up0.3.3.tgz new file mode 100644 index 000000000..abef0673b Binary files /dev/null and b/assets/prometheus-federator/prometheus-federator-0.3.0+up0.3.3.tgz differ diff --git a/assets/rancher-aks-operator-crd/rancher-aks-operator-crd-102.3.2+up1.1.3.tgz b/assets/rancher-aks-operator-crd/rancher-aks-operator-crd-102.3.2+up1.1.3.tgz new file mode 100644 index 000000000..3c2c25b6d Binary files /dev/null and b/assets/rancher-aks-operator-crd/rancher-aks-operator-crd-102.3.2+up1.1.3.tgz differ diff --git a/assets/rancher-aks-operator/rancher-aks-operator-102.3.2+up1.1.3.tgz b/assets/rancher-aks-operator/rancher-aks-operator-102.3.2+up1.1.3.tgz new file mode 100644 index 000000000..359b5c802 Binary files /dev/null and b/assets/rancher-aks-operator/rancher-aks-operator-102.3.2+up1.1.3.tgz differ diff --git a/charts/epinio-crd/102.0.4+up1.9.0/Chart.yaml b/charts/epinio-crd/102.0.4+up1.9.0/Chart.yaml new file mode 100644 index 000000000..0837f21f5 --- /dev/null +++ b/charts/epinio-crd/102.0.4+up1.9.0/Chart.yaml @@ -0,0 +1,10 @@ +annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/namespace: cattle-epinio-system + catalog.cattle.io/release-name: epinio-crd +apiVersion: v2 +description: Installs the CRDs for Epinio. +name: epinio-crd +type: application +version: 102.0.4+up1.9.0 diff --git a/charts/epinio-crd/102.0.4+up1.9.0/README.md b/charts/epinio-crd/102.0.4+up1.9.0/README.md new file mode 100644 index 000000000..527081aec --- /dev/null +++ b/charts/epinio-crd/102.0.4+up1.9.0/README.md @@ -0,0 +1,2 @@ +# epinio-crd +A Rancher chart that installs the CRDs used by epinio. diff --git a/charts/epinio-crd/102.0.4+up1.9.0/templates/app-crd.yaml b/charts/epinio-crd/102.0.4+up1.9.0/templates/app-crd.yaml new file mode 100644 index 000000000..bae8a1f9c --- /dev/null +++ b/charts/epinio-crd/102.0.4+up1.9.0/templates/app-crd.yaml @@ -0,0 +1,118 @@ +# Copied from here: +# https://github.com/epinio/application/blob/main/config/crd/bases/application.epinio.io_apps.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.4.1 + creationTimestamp: null + name: apps.application.epinio.io +spec: + group: application.epinio.io + names: + kind: App + listKind: AppList + plural: apps + singular: app + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + description: App is the Schema for the apps API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: AppSpec defines the desired state of App + properties: + blobuid: + description: BlobUID stores the blob uid that was used when the application + was last staged (from code). It can be empty if the application + was never staged (e.g. pushed with container image). Epinio will + use the value set by the user explicitly but if one is not set, + it will try to use the previously set blobUID from the application + CRD. + type: string + builderimage: + description: This field stores the builder image that was used when + the application was last staged (from code). It can be empty if + the application was never staged (e.g. pushed with container image). + Epinio will use the builder image set by the user explicitly but + if one is not set, it will try to use the previously set image. + type: string + chartname: + description: ChartName stores the name of the application support + chart used to deploy the currently running application. This is + set on deployment, for use in updates. The name references an epinio + AppCharts resource. + type: string + imageurl: + description: ImageURL stores the image reference of the currently + running application. This is set on deployment, for use in updates. + type: string + origin: + properties: + archive: + type: boolean + container: + type: string + git: + properties: + branch: + type: string + provider: + type: string + repository: + type: string + revision: + type: string + required: + - repository + type: object + path: + type: string + type: object + routes: + items: + type: string + type: array + settings: + additionalProperties: + type: string + description: Settings stores the fields and values set by the user + to configure the application chart. See ChartName. + type: object + stageid: + description: StageID stores the id of the latest attempt to stage + the application, regardless of outcome. This enables access to the + staging logs of an application which never staged successfully. + type: string + required: + - origin + type: object + status: + description: AppStatus defines the observed state of App + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/epinio-crd/102.0.4+up1.9.0/templates/appcharts-crd.yaml b/charts/epinio-crd/102.0.4+up1.9.0/templates/appcharts-crd.yaml new file mode 100644 index 000000000..940ea6dc5 --- /dev/null +++ b/charts/epinio-crd/102.0.4+up1.9.0/templates/appcharts-crd.yaml @@ -0,0 +1,108 @@ +# Copied from here: +# https://github.com/epinio/application/blob/main/config/crd/bases/application.epinio.io_appcharts.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.4.1 + creationTimestamp: null + name: appcharts.application.epinio.io +spec: + group: application.epinio.io + names: + kind: AppChart + listKind: AppChartList + plural: appcharts + singular: appchart + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + description: AppChart is the Schema for the appcharts API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: AppChartSpec defines the desired state of AppChart + properties: + description: + description: Description of the chart. Long form to be used in detailed + displays + type: string + helmChart: + description: HelmChart is the name of the Helm chart used to deploy + an application. + type: string + helmRepo: + description: HelmRepo is the URL to the Helm repository where to fetch + the helm chart. This can be empty. In that case the HelmChart field + has to reference the chart as full URL instead of as a simple name. + type: string + settings: + additionalProperties: + description: AppChartSetting is an older name for ChartSetting. + Created to keep backward compatibility. Should also reduce misunderstandings + of what kind of settings are handled in a particular context. + properties: + enum: + description: Enumeration of allowed values, for types string, + number, integer + items: + type: string + type: array + maximum: + description: Maximal allowed value, for number, integer + type: string + minimum: + description: Minimal allowed value, for number, integer + type: string + type: + description: Type of the setting (string, bool, number, or integer) + type: string + required: + - type + type: object + description: Settings declares the fields underneath `userValues` + the user is allowed to customize when deploying an application with + the helm chart referenced by this app chart. + type: object + shortDescription: + description: ShortDescription of the chart. To be used in list displays + type: string + values: + additionalProperties: + type: string + description: Values provides settings, i.e. field names and values + to customize the referenced helm chart when deploying an application + with this app chart. Note that user-configurable settings are declared + with `Settings` instead. While nothing checks against exposing a + field set here to the user this is strongly discouraged, to avoid + confusion. + type: object + type: object + status: + description: AppChartStatus defines the observed state of AppChart + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/epinio-crd/102.0.4+up1.9.0/templates/service-crd.yaml b/charts/epinio-crd/102.0.4+up1.9.0/templates/service-crd.yaml new file mode 100644 index 000000000..017f5478b --- /dev/null +++ b/charts/epinio-crd/102.0.4+up1.9.0/templates/service-crd.yaml @@ -0,0 +1,120 @@ +# Copied from here: +# https://github.com/epinio/application/blob/main/config/crd/bases/application.epinio.io_services.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.4.1 + creationTimestamp: null + name: services.application.epinio.io +spec: + group: application.epinio.io + names: + kind: Service + listKind: ServiceList + plural: services + singular: service + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + description: Service is the Schema for the services API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ServiceSpec defines the desired state of Service + properties: + appVersion: + description: AppVersion is the version of the service deployed by + the referenced chart + type: string + chart: + description: HelmChart is the name of the Helm chart used to deploy + the service + type: string + chartVersion: + description: ChartVersion is the version of the Helm chart used to + deploy the service + type: string + description: + description: Description of the service to be used when the service + is described + type: string + helmRepo: + description: HelmRepo is the Helm repository where to fetch the helm + chart + properties: + name: + type: string + url: + type: string + type: object + name: + description: Name of the service (i.e. redis-small) + type: string + serviceIcon: + description: ServiceIcon is an image associated with this service + type: string + settings: + additionalProperties: + description: ServiceSetting is an alias to ChartSetting. Should + reduce misunderstandings of what kind of settings are handled + in a particular context. + properties: + enum: + description: Enumeration of allowed values, for types string, + number, integer + items: + type: string + type: array + maximum: + description: Maximal allowed value, for number, integer + type: string + minimum: + description: Minimal allowed value, for number, integer + type: string + type: + description: Type of the setting (string, bool, number, or integer) + type: string + required: + - type + type: object + description: Settings declares the fields the user is allowed to customize + when deploying a service with the helm chart referenced by this + service class. + type: object + shortDescription: + description: ShortDescription of the service to be used in lists + type: string + values: + description: Values are the values provided by the operator. They + are used to customize the deployment of the service. + type: string + type: object + status: + description: ServiceStatus defines the observed state of Service + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/epinio/102.0.4+up1.9.0/Chart.lock b/charts/epinio/102.0.4+up1.9.0/Chart.lock new file mode 100644 index 000000000..3f884a51a --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/Chart.lock @@ -0,0 +1,15 @@ +dependencies: +- name: dex + repository: https://charts.dexidp.io + version: 0.14.3 +- name: minio + repository: https://charts.min.io/ + version: 5.0.13 +- name: kubed + repository: https://charts.appscode.com/stable/ + version: v0.13.2 +- name: s3gw + repository: https://aquarist-labs.github.io/s3gw-charts + version: 0.14.0 +digest: sha256:bb126710c2f9a5b3d92dcb6186b97747881fd323fbfe0a53cda5194dc9f1000d +generated: "2023-07-18T14:35:31.781489759+02:00" diff --git a/charts/epinio/102.0.4+up1.9.0/Chart.yaml b/charts/epinio/102.0.4+up1.9.0/Chart.yaml new file mode 100644 index 000000000..957d6ea0e --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/Chart.yaml @@ -0,0 +1,51 @@ +annotations: + artifacthub.io/license: Apache-2.0 + artifacthub.io/prerelease: "false" + catalog.cattle.io/auto-install: epinio-crd=match + catalog.cattle.io/certified: rancher + catalog.cattle.io/display-name: Epinio + catalog.cattle.io/experimental: "true" + catalog.cattle.io/kube-version: '>= 1.23.0-0 < 1.28.0-0' + catalog.cattle.io/namespace: cattle-epinio-system + catalog.cattle.io/permits-os: linux + catalog.cattle.io/rancher-version: '>= 2.7.0-0 < 2.8.0-0' + catalog.cattle.io/release-name: epinio + catalog.cattle.io/type: app + catalog.cattle.io/upstream-version: 1.9.0 +apiVersion: v2 +appVersion: v1.9.0 +dependencies: +- condition: global.dex.enabled + name: dex + repository: file://./charts/dex + tags: + - dex +- condition: kubed.enabled, global.kubed.enabled + name: kubed + repository: file://./charts/kubed + tags: + - kubed +- condition: minio.enabled, global.minio.enabled + name: minio + repository: file://./charts/minio + tags: + - minio +- condition: s3gw.enabled, global.s3gw.enabled + name: s3gw + repository: file://./charts/s3gw + tags: + - s3gw +description: Epinio deploys Kubernetes applications directly from source code in one + step. +home: https://github.com/epinio/epinio +icon: https://charts.rancher.io/assets/logos/epinio.svg +keywords: +- epinio +- paas +maintainers: +- email: team@epinio.io + name: SUSE +name: epinio +sources: +- https://github.com/epinio/epinio +version: 102.0.4+up1.9.0 diff --git a/charts/epinio/102.0.4+up1.9.0/README.md b/charts/epinio/102.0.4+up1.9.0/README.md new file mode 100644 index 000000000..2e1b39df1 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/README.md @@ -0,0 +1,100 @@ +# Epinio Helm Chart + +From app to URL in one command. + +## Introduction + +This chart deploys Epinio PaaS on a Kubernetes cluster. It also deploys some of +its dependencies as subcharts. + +The documentation is centralized in the [doc website](https://docs.epinio.io). + +## Prerequisites + +Epinio needs a number of external components to be running on your cluster in order to +work. You may already have those deployed, otherwise follow the instructions here +to deploy them. + +Important: Some of the namespaces of the components are hardcoded in the Epinio +code and thus are important to be the same as described here. In the future this +may be configurable on the Epinio Helm chart. + +### Ingress Controller + +Epinio creates Ingress resources for the API server, the applications and depending +on your setup, the internal container registry. Those resources won't work unless +an Ingress controller is running on your cluster. + +If you don't have an Ingress controller already running, you can install Traefik with: + +``` +$ kubectl create namespace traefik +$ export LOAD_BALANCER_IP=$(LOAD_BALANCER_IP:-) # Set this to the IP of your load balancer if you know that +$ helm install traefik --namespace traefik "https://helm.traefik.io/traefik/traefik-10.3.4.tgz" \ + --set globalArguments='' \ + --set-string ports.web.redirectTo=websecure \ + --set-string ingressClass.enabled=true \ + --set-string ingressClass.isDefaultClass=true \ + --set-string service.spec.loadBalancerIP=$LOAD_BALANCER_IP +``` + +### Cert Manager + +Epinio needs [cert-manager](https://cert-manager.io/) in order to create TLS +certificates for the various Ingresses (see "Ingress controller" above). + +If cert-manager is not already installed on the cluster, it can be installed like this: + +``` +$ kubectl create namespace cert-manager +$ helm repo add jetstack https://charts.jetstack.io +$ helm repo update +$ helm install cert-manager --namespace cert-manager jetstack/cert-manager \ + --set installCRDs=true \ + --set extraArgs[0]=--enable-certificate-owner-ref=true +``` + +### Kubed + +Kubed is installed as a subchart when `.Values.kubed.enabled` is true (default). +If you already have kubed running, you can skip the installation by setting +the helm value "kubed.enabled" to "false". + +### S3 storage + +Epinio is using an S3 compatible storage to store the application source code. + +This chart will install [Minio](https://min.io/) when `.Values.minio.enabled` is +true (default). + +This chart will install [s3gw](https://s3gw.io/) when `.Values.s3gw.enabled` is +true. + +Any S3 compatible solution can be used instead by setting the aforementioned values +to `false` and using [the values under `s3`](https://github.com/epinio/helm-charts/blob/main/chart/epinio/values.yaml#L44) +to point to the desired S3 server. + +### Container Registry + +When Epinio builds a container image for an application from source, it needs +to store that image to a container registry. Epinio installs a container registry +on the cluster when `.Values.containerregistry.enabled` is `true` (default). + +Any container registry that supports basic auth authentication can be used (e.g. gcr, dockerhub etc) +instead by setting this value to `false` and using +[the values under `registry`](https://github.com/epinio/helm-charts/blob/main/chart/epinio/values.yaml#L104-L107) +to point to the desired container registry. + +## Install Epinio + +If the above dependencies are available or going to be installed by this chart, +Epinio can be installed with the following: + +``` +$ helm repo add epinio https://epinio.github.io/helm-charts/ +$ helm install epinio -n epinio --create-namespace epinio/epinio --values epinio-values.yaml --set global.domain=myepiniodomain.org +``` + +The only value that is mandatory is the `.Values.global.domain` which +should be a wildcard domain, pointing to the IP address of your running +Ingress controller. diff --git a/charts/epinio/102.0.4+up1.9.0/app-readme.md b/charts/epinio/102.0.4+up1.9.0/app-readme.md new file mode 100644 index 000000000..1c8d7bd6d --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/app-readme.md @@ -0,0 +1,37 @@ +# Epinio PaaS + +Opinionated platform that runs on Kubernetes to take you from Code to URL in one step. + +__Attention__: + + - Requires `cert-manager` as dependency. + - Requires `helm-controller` as dependency. + +## Upgrading to Kubernetes v1.25+ + +Starting in Kubernetes v1.25, [Pod Security Policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/) +have been removed from the Kubernetes API. + +As a result, __before upgrading to Kubernetes v1.25__ (or on a fresh install in a Kubernetes v1.25+ +cluster), users are expected to perform an in-place upgrade of this chart with +`global.cattle.psp.enabled` set to `false` if it has been previously set to `true`. + +​> __Note:__ +> In this chart release, any previous field that was associated with any PSP resources have been +> removed in favor of a single global field: `global.cattle.psp.enabled`. + +> __Note:__ +> If you upgrade your cluster to Kubernetes v1.25+ before removing PSPs via a `helm upgrade` (even +> if you manually clean up resources), __it will leave the Helm release in a broken state within the +> cluster such that further Helm operations will not work (`helm uninstall`, `helm upgrade`, +> etc.).__ +> +> If your charts get stuck in this state, please consult the Rancher docs on how to clean up your +> Helm release secrets. + +Upon setting `global.cattle.psp.enabled` to false, the chart will remove any PSP resources deployed +on its behalf from the cluster. This is the default setting for this chart. ​ + +As a replacement for PSPs, [Pod Security Admission](https://kubernetes.io/docs/concepts/security/pod-security-admission/) +should be used. Please consult the Rancher docs for more details on how to configure your chart +release namespaces to work with the new Pod Security Admission and apply Pod Security Standards. diff --git a/charts/epinio/102.0.4+up1.9.0/assets/epinio-application-0.1.26.tgz b/charts/epinio/102.0.4+up1.9.0/assets/epinio-application-0.1.26.tgz new file mode 100644 index 000000000..586d2db88 Binary files /dev/null and b/charts/epinio/102.0.4+up1.9.0/assets/epinio-application-0.1.26.tgz differ diff --git a/charts/epinio/102.0.4+up1.9.0/charts/dex/.helmignore b/charts/epinio/102.0.4+up1.9.0/charts/dex/.helmignore new file mode 100644 index 000000000..00ca644b2 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/dex/.helmignore @@ -0,0 +1,25 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ + +README.md.gotmpl diff --git a/charts/epinio/102.0.4+up1.9.0/charts/dex/Chart.yaml b/charts/epinio/102.0.4+up1.9.0/charts/dex/Chart.yaml new file mode 100644 index 000000000..8015d9a1d --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/dex/Chart.yaml @@ -0,0 +1,29 @@ +annotations: + artifacthub.io/changes: | + - kind: added + description: "Use updated HorizontalPodAutoscaler API Version which is no longer served in K8s >=1.25" + artifacthub.io/images: | + - name: dex + image: ghcr.io/dexidp/dex:v2.36.0 +apiVersion: v2 +appVersion: 2.36.0 +description: OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable + connectors. +home: https://dexidp.io/ +icon: https://dexidp.io/favicon.png +keywords: +- oidc +- oauth +- identity-provider +- saml +kubeVersion: '>=1.14.0-0' +maintainers: +- email: mark.sagikazar@gmail.com + name: sagikazarmark + url: https://sagikazarmark.hu +name: dex +sources: +- https://github.com/dexidp/dex +- https://github.com/dexidp/helm-charts/tree/master/charts/dex +type: application +version: 0.14.3 diff --git a/charts/epinio/102.0.4+up1.9.0/charts/dex/LICENSE b/charts/epinio/102.0.4+up1.9.0/charts/dex/LICENSE new file mode 100644 index 000000000..d64569567 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/dex/LICENSE @@ -0,0 +1,202 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/charts/epinio/102.0.4+up1.9.0/charts/dex/README.md b/charts/epinio/102.0.4+up1.9.0/charts/dex/README.md new file mode 100644 index 000000000..e3539a9d5 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/dex/README.md @@ -0,0 +1,187 @@ +# dex + +![version: 0.14.3](https://img.shields.io/badge/version-0.14.3-informational?style=flat-square) ![type: application](https://img.shields.io/badge/type-application-informational?style=flat-square) ![app version: 2.36.0](https://img.shields.io/badge/app%20version-2.36.0-informational?style=flat-square) ![kube version: >=1.14.0-0](https://img.shields.io/badge/kube%20version->=1.14.0--0-informational?style=flat-square) [![artifact hub](https://img.shields.io/badge/artifact%20hub-dex-informational?style=flat-square)](https://artifacthub.io/packages/helm/dex/dex) + +OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors. + +**Homepage:** + +## TL;DR; + +```bash +helm repo add dex https://charts.dexidp.io +helm install --generate-name --wait dex/dex +``` + +## Getting started + +### Minimal configuration + +Dex requires a minimal configuration in order to work. +You can pass configuration to Dex using Helm values: + +```yaml +config: + # Set it to a valid URL + issuer: http://my-issuer-url.com + + # See https://dexidp.io/docs/storage/ for more options + storage: + type: memory + + # Enable at least one connector + # See https://dexidp.io/docs/connectors/ for more options + enablePasswordDB: true +``` + +The above configuration won't make Dex automatically available on the configured URL. +One (and probably the easiest) way to achieve that is configuring ingress: + +```yaml +ingress: + enabled: true + + hosts: + - host: my-issuer-url.com + paths: + - path: / +``` + +### Minimal TLS configuration + +HTTPS is basically mandatory these days, especially for authentication and authorization services. +There are several solutions for protecting services with TlS in Kubernetes, +but by far the most popular and portable is undoubtedly [Cert Manager](https://cert-manager.io). + +Cert Manager can be [installed](https://cert-manager.io/docs/installation/kubernetes) with a few steps: + +```shell +helm repo add jetstack https://charts.jetstack.io +helm repo update +kubectl create namespace cert-manager +helm install \ + cert-manager jetstack/cert-manager \ + --namespace cert-manager \ + --set installCRDs=true +``` + +The next step is setting up an [issuer](https://cert-manager.io/docs/concepts/issuer/) (eg. [Let's Encrypt](https://letsencrypt.org/)): + +```shell +cat <=1.23-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: autoscaling/v2 +{{- else -}} +apiVersion: autoscaling/v2beta1 +{{- end }} +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "dex.fullname" . }} + labels: + {{- include "dex.labels" . | nindent 4 }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "dex.fullname" . }} + minReplicas: {{ .Values.autoscaling.minReplicas }} + maxReplicas: {{ .Values.autoscaling.maxReplicas }} + metrics: + {{- if .Values.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} + {{- end }} + {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/dex/templates/ingress.yaml b/charts/epinio/102.0.4+up1.9.0/charts/dex/templates/ingress.yaml new file mode 100644 index 000000000..0b881d045 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/dex/templates/ingress.yaml @@ -0,0 +1,61 @@ +{{- if .Values.ingress.enabled -}} +{{- $fullName := include "dex.fullname" . -}} +{{- $svcPort := .Values.service.ports.http.port -}} +{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }} + {{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }} + {{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}} + {{- end }} +{{- end }} +{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1 +{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1beta1 +{{- else -}} +apiVersion: extensions/v1beta1 +{{- end }} +kind: Ingress +metadata: + name: {{ $fullName }} + labels: + {{- include "dex.labels" . | nindent 4 }} + {{- with .Values.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }} + ingressClassName: {{ .Values.ingress.className }} + {{- end }} + {{- if .Values.ingress.tls }} + tls: + {{- range .Values.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ tpl . $ | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} + {{- end }} + rules: + {{- range .Values.ingress.hosts }} + - host: {{ tpl .host $ | quote }} + http: + paths: + {{- range .paths }} + - path: {{ .path }} + {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }} + pathType: {{ .pathType }} + {{- end }} + backend: + {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }} + service: + name: {{ $fullName }} + port: + number: {{ $svcPort }} + {{- else }} + serviceName: {{ $fullName }} + servicePort: {{ $svcPort }} + {{- end }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/dex/templates/networkpolicy.yaml b/charts/epinio/102.0.4+up1.9.0/charts/dex/templates/networkpolicy.yaml new file mode 100644 index 000000000..acd51b9d8 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/dex/templates/networkpolicy.yaml @@ -0,0 +1,35 @@ +{{- if .Values.networkPolicy.enabled }} +{{- if semverCompare "<1.7-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: extensions/v1beta1 +{{- else -}} +apiVersion: networking.k8s.io/v1 +{{- end }} +kind: NetworkPolicy +metadata: + name: {{ include "dex.fullname" . }} + labels: + {{- include "dex.labels" . | nindent 4 }} +spec: + policyTypes: + {{- if .Values.networkPolicy.egressRules }} + - Egress + {{- end }} + - Ingress + podSelector: + matchLabels: + {{- include "dex.selectorLabels" . | nindent 6 }} + ingress: + - ports: + - port: http + {{- if .Values.https.enabled }} + - port: https + {{- end }} + {{- if .Values.grpc.enabled }} + - port: grpc + {{- end }} + - port: telemetry + {{- with .Values.networkPolicy.egressRules }} + egress: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/dex/templates/poddisruptionbudget.yaml b/charts/epinio/102.0.4+up1.9.0/charts/dex/templates/poddisruptionbudget.yaml new file mode 100644 index 000000000..6ec1032ad --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/dex/templates/poddisruptionbudget.yaml @@ -0,0 +1,22 @@ +{{- if .Values.podDisruptionBudget.enabled }} +{{- if semverCompare ">=1.21-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: policy/v1 +{{- else -}} +apiVersion: policy/v1beta1 +{{- end }} +kind: PodDisruptionBudget +metadata: + name: {{ template "dex.fullname" . }} + labels: +{{ include "dex.labels" . | indent 4 }} +spec: + {{- with .Values.podDisruptionBudget.minAvailable }} + minAvailable: {{ . }} + {{- end }} + {{- with .Values.podDisruptionBudget.maxUnavailable }} + maxUnavailable: {{ . }} + {{- end }} + selector: + matchLabels: + {{- include "dex.selectorLabels" . | nindent 6 }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/dex/templates/psp.yaml b/charts/epinio/102.0.4+up1.9.0/charts/dex/templates/psp.yaml new file mode 100644 index 000000000..7b30c45e0 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/dex/templates/psp.yaml @@ -0,0 +1,86 @@ +{{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy" -}} +{{- if .Values.serviceAccount.create }} +{{- if .Values.global.rbac.pspEnabled }} + +--- +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: {{ printf "%s-psp" .Values.serviceAccount.name | quote }} + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: "{{ replace "+" "_" .Chart.Version }}" + app.kubernetes.io/part-of: {{ .Values.serviceAccount.name | quote }} + app: {{ .Values.serviceAccount.name | quote }} +{{- if .Values.global.rbac.pspAnnotations }} + annotations: {{ toYaml .Values.global.rbac.pspAnnotations | nindent 4 }} +{{- end }} +spec: + privileged: false + hostNetwork: false + hostIPC: false + hostPID: false + runAsUser: + # Permits the container to run with root privileges as well. + rule: 'RunAsAny' + seLinux: + # This policy assumes the nodes are using AppArmor rather than SELinux. + rule: 'RunAsAny' + supplementalGroups: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 0 + max: 65535 + fsGroup: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 0 + max: 65535 + readOnlyRootFilesystem: false + +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ printf "%s-psp" .Values.serviceAccount.name | quote }} + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: "{{ replace "+" "_" .Chart.Version }}" + app.kubernetes.io/part-of: {{ .Values.serviceAccount.name | quote }} + app: {{ .Values.serviceAccount.name | quote }} +rules: +{{- if semverCompare "> 1.15.0-0" .Capabilities.KubeVersion.GitVersion }} +- apiGroups: ['policy'] +{{- else }} +- apiGroups: ['extensions'] +{{- end }} + resources: ['podsecuritypolicies'] + verbs: ['use'] + resourceNames: + - {{ printf "%s-psp" .Values.serviceAccount.name | quote }} + +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ printf "%s-psp" .Values.serviceAccount.name | quote }} + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: "{{ replace "+" "_" .Chart.Version }}" + app.kubernetes.io/part-of: {{ .Values.serviceAccount.name | quote }} + app: {{ .Values.serviceAccount.name | quote }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ printf "%s-psp" .Values.serviceAccount.name | quote }} +subjects: + - kind: ServiceAccount + name: {{ .Values.serviceAccount.name | quote }} + namespace: {{ .Release.Namespace }} + +{{- end }} +{{- end }} +{{- end -}} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/dex/templates/rbac.yaml b/charts/epinio/102.0.4+up1.9.0/charts/dex/templates/rbac.yaml new file mode 100644 index 000000000..333f2f100 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/dex/templates/rbac.yaml @@ -0,0 +1,55 @@ +{{- if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ include "dex.fullname" . }} + labels: + {{- include "dex.labels" . | nindent 4 }} +rules: + - apiGroups: ["dex.coreos.com"] + resources: ["*"] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ include "dex.fullname" . }} + labels: + {{- include "dex.labels" . | nindent 4 }} +roleRef: + kind: Role + apiGroup: rbac.authorization.k8s.io + name: {{ include "dex.fullname" . }} +subjects: +- kind: ServiceAccount + namespace: {{ .Release.Namespace }} + name: {{ include "dex.serviceAccountName" . }} +{{- if .Values.rbac.createClusterScoped }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "dex.fullname" . }} + labels: + {{- include "dex.labels" . | nindent 4 }} +rules: + - apiGroups: ["apiextensions.k8s.io"] + resources: ["customresourcedefinitions"] + verbs: ["list", "create"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ include "dex.fullname" . }}-cluster + labels: + {{- include "dex.labels" . | nindent 4 }} +roleRef: + kind: ClusterRole + apiGroup: rbac.authorization.k8s.io + name: {{ include "dex.fullname" . }} +subjects: +- kind: ServiceAccount + namespace: {{ .Release.Namespace }} + name: {{ include "dex.serviceAccountName" . }} +{{- end }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/dex/templates/secret.yaml b/charts/epinio/102.0.4+up1.9.0/charts/dex/templates/secret.yaml new file mode 100644 index 000000000..27d39546e --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/dex/templates/secret.yaml @@ -0,0 +1,11 @@ +{{- if .Values.configSecret.create -}} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "dex.configSecretName" . }} + labels: + {{- include "dex.labels" . | nindent 4 }} +type: Opaque +data: + config.yaml: {{ .Values.config | toYaml | b64enc | quote }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/dex/templates/service.yaml b/charts/epinio/102.0.4+up1.9.0/charts/dex/templates/service.yaml new file mode 100644 index 000000000..8114e8d59 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/dex/templates/service.yaml @@ -0,0 +1,59 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "dex.fullname" . }} + labels: + {{- include "dex.labels" . | nindent 4 }} + {{- with .Values.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + type: {{ .Values.service.type }} + {{- with .Values.service.clusterIP }} + clusterIP: {{ . }} + {{- end }} + ports: + - name: http + port: {{ .Values.service.ports.http.port }} + {{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) .Values.service.ports.http.nodePort }} + nodePort: {{ .Values.service.ports.http.nodePort }} + {{- end }} + targetPort: http + protocol: TCP + {{- if semverCompare ">=1.20-0" .Capabilities.KubeVersion.GitVersion }} + appProtocol: http + {{- end }} + {{- if .Values.https.enabled }} + - name: https + port: {{ .Values.service.ports.https.port }} + {{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) .Values.service.ports.https.nodePort }} + nodePort: {{ .Values.service.ports.https.nodePort }} + {{- end }} + targetPort: https + protocol: TCP + {{- if semverCompare ">=1.20-0" .Capabilities.KubeVersion.GitVersion }} + appProtocol: https + {{- end }} + {{- end }} + {{- if .Values.grpc.enabled }} + - name: grpc + port: {{ .Values.service.ports.grpc.port }} + {{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) .Values.service.ports.grpc.nodePort }} + nodePort: {{ .Values.service.ports.grpc.nodePort }} + {{- end }} + targetPort: grpc + protocol: TCP + {{- if semverCompare ">=1.20-0" .Capabilities.KubeVersion.GitVersion }} + appProtocol: http + {{- end }} + {{- end }} + - name: telemetry + port: 5558 + targetPort: telemetry + protocol: TCP + {{- if semverCompare ">=1.20-0" .Capabilities.KubeVersion.GitVersion }} + appProtocol: http + {{- end }} + selector: + {{- include "dex.selectorLabels" . | nindent 4 }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/dex/templates/serviceaccount.yaml b/charts/epinio/102.0.4+up1.9.0/charts/dex/templates/serviceaccount.yaml new file mode 100644 index 000000000..30c3ddd90 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/dex/templates/serviceaccount.yaml @@ -0,0 +1,12 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "dex.serviceAccountName" . }} + labels: + {{- include "dex.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/dex/templates/servicemonitor.yaml b/charts/epinio/102.0.4+up1.9.0/charts/dex/templates/servicemonitor.yaml new file mode 100644 index 000000000..ce96e5be1 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/dex/templates/servicemonitor.yaml @@ -0,0 +1,54 @@ +{{- if .Values.serviceMonitor.enabled }} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + {{- with .Values.serviceMonitor.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ include "dex.fullname" . }} + {{- with .Values.serviceMonitor.namespace }} + namespace: {{ . }} + {{- end }} + labels: + {{- include "dex.labels" . | nindent 4 }} + {{- with .Values.serviceMonitor.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + endpoints: + - port: telemetry + {{- with .Values.serviceMonitor.interval }} + interval: {{ . }} + {{- end }} + {{- with .Values.serviceMonitor.scheme }} + scheme: {{ . }} + {{- end }} + {{- with .Values.serviceMonitor.bearerTokenFile }} + bearerTokenFile: {{ . }} + {{- end }} + {{- with .Values.serviceMonitor.tlsConfig }} + tlsConfig: + {{- toYaml .| nindent 6 }} + {{- end }} + {{- with .Values.serviceMonitor.scrapeTimeout }} + scrapeTimeout: {{ . }} + {{- end }} + path: {{ .Values.serviceMonitor.path }} + honorLabels: {{ .Values.serviceMonitor.honorLabels }} + {{- with .Values.serviceMonitor.metricRelabelings }} + metricRelabelings: + {{- tpl (toYaml . | nindent 6) $ }} + {{- end }} + {{- with .Values.serviceMonitor.relabelings }} + relabelings: + {{- toYaml . | nindent 6 }} + {{- end }} + jobLabel: {{ include "dex.fullname" . }} + selector: + matchLabels: + {{- include "dex.selectorLabels" . | nindent 6 }} + namespaceSelector: + matchNames: + - {{ .Release.Namespace }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/dex/templates/tests/no-config-secret.yaml b/charts/epinio/102.0.4+up1.9.0/charts/dex/templates/tests/no-config-secret.yaml new file mode 100644 index 000000000..4b7804f54 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/dex/templates/tests/no-config-secret.yaml @@ -0,0 +1,13 @@ +{{- if not .Values.configSecret.create -}} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "dex.configSecretName" . }}-test-no-create + labels: + {{- include "dex.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": test +type: Opaque +data: + config.yaml: {{ .Values.config | toYaml | b64enc | quote }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/dex/values.yaml b/charts/epinio/102.0.4+up1.9.0/charts/dex/values.yaml new file mode 100644 index 000000000..a00c9bad6 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/dex/values.yaml @@ -0,0 +1,324 @@ +# Default values for dex. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +# -- Number of replicas (pods) to launch. +replicaCount: 1 + +# -- Labels to apply to all resources and selectors. +commonLabels: {} +# team_name: dev + +image: + # -- Name of the image repository to pull the container image from. + repository: rancher/mirrored-dexidp-dex + tag: v2.36.0 + + # -- [Image pull policy](https://kubernetes.io/docs/concepts/containers/images/#updating-images) for updating already existing images on a node. + pullPolicy: IfNotPresent + +# -- Reference to one or more secrets to be used when [pulling images](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#create-a-pod-that-uses-your-secret) (from private registries). +imagePullSecrets: [] + +# -- A name in place of the chart name for `app:` labels. +nameOverride: "" + +# -- A name to substitute for the full names of resources. +fullnameOverride: "" + +# -- A list of hosts and IPs that will be injected into the pod's hosts file if specified. +# See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#hostname-and-name-resolution) +hostAliases: [] + +https: + # -- Enable the HTTPS endpoint. + enabled: false + +grpc: + # -- Enable the gRPC endpoint. + # Read more in the [documentation](https://dexidp.io/docs/api/). + enabled: false + +configSecret: + # -- Enable creating a secret from the values passed to `config`. + # If set to false, name must point to an existing secret. + create: true + + # -- The name of the secret to mount as configuration in the pod. + # If not set and create is true, a name is generated using the fullname template. + # Must point to secret that contains at least a `config.yaml` key. + name: "" + +# -- Application configuration. +# See the [official documentation](https://dexidp.io/docs/). +config: {} + +# -- Additional storage [volumes](https://kubernetes.io/docs/concepts/storage/volumes/). +# See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes-1) for details. +volumes: [] + +# -- Additional [volume mounts](https://kubernetes.io/docs/tasks/configure-pod-container/configure-volume-storage/). +# See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes-1) for details. +volumeMounts: [] + +# -- Additional environment variables mounted from [secrets](https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-environment-variables) or [config maps](https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/#configure-all-key-value-pairs-in-a-configmap-as-container-environment-variables). +# See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#environment-variables) for details. +envFrom: [] + +# -- Additional environment variables passed directly to containers. +# See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#environment-variables) for details. +env: {} + +# -- Similar to env but with support for all possible configurations. +# See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#environment-variables) for details. +envVars: [] +# - name: SOME_ENV_VAR +# value: value +# - name: SOME_ENV_VAR2 +# valueFrom: +# secretKeyRef: +# name: secret-name +# key: secret-key +# - name: SOME_ENV_VAR3 +# valueFrom: +# configMapKeyRef: +# name: config-map-name +# key: config-map-key + +serviceAccount: + # -- Enable service account creation. + create: true + + # -- Annotations to be added to the service account. + annotations: {} + + # -- The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template. + name: "dex-sa" + +rbac: + # -- Specifies whether RBAC resources should be created. + # If disabled, the operator is responsible for creating the necessary resources based on the templates. + create: true + + # -- Specifies which RBAC resources should be created. + # If disabled, the operator is responsible for creating the necessary resources (ClusterRole and RoleBinding or CRD's) + createClusterScoped: true + +# -- Annotations to be added to deployment. +deploymentAnnotations: {} + +# -- Labels to be added to deployment. +deploymentLabels: {} + +# -- Annotations to be added to pods. +podAnnotations: {} + +# -- Labels to be added to pods. +podLabels: {} + +podDisruptionBudget: + # -- Enable a [pod distruption budget](https://kubernetes.io/docs/tasks/run-application/configure-pdb/) to help dealing with [disruptions](https://kubernetes.io/docs/concepts/workloads/pods/disruptions/). + # It is **highly recommended** for webhooks as disruptions can prevent launching new pods. + enabled: false + + # -- (int/percentage) Number or percentage of pods that must remain available. + minAvailable: + + # -- (int/percentage) Number or percentage of pods that can be unavailable. + maxUnavailable: + +# -- Specify a priority class name to set [pod priority](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#pod-priority). +priorityClassName: "" + +# -- Pod [security context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod). +# See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context) for details. +podSecurityContext: {} + # fsGroup: 2000 + +# -- Container [security context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container). +# See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1) for details. +securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 + +service: + # -- Annotations to be added to the service. + annotations: {} + + # -- Kubernetes [service type](https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types). + type: ClusterIP + + # -- Internal cluster service IP (when applicable) + clusterIP: "" + + ports: + http: + # -- HTTP service port + port: 5556 + + # -- (int) HTTP node port (when applicable) + nodePort: + + https: + # -- HTTPS service port + port: 5554 + + # -- (int) HTTPS node port (when applicable) + nodePort: + + grpc: + # -- gRPC service port + port: 5557 + + # -- (int) gRPC node port (when applicable) + nodePort: + +ingress: + # -- Enable [ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/). + enabled: false + + # -- Ingress [class name](https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class). + className: "" + + # -- Annotations to be added to the ingress. + annotations: {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + + # -- Ingress host configuration. + # @default -- See [values.yaml](values.yaml). + hosts: + - host: chart-example.local + paths: + - path: / + pathType: ImplementationSpecific + + # -- Ingress TLS configuration. + # @default -- See [values.yaml](values.yaml). + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + +serviceMonitor: + # -- Enable Prometheus ServiceMonitor. + # See the [documentation](https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/design.md#servicemonitor) and the [API reference](https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#servicemonitor) for details. + enabled: false + + # -- Namespace where the ServiceMonitor resource should be deployed. + # @default -- Release namespace. + namespace: "" + + # -- (duration) Prometheus scrape interval. + interval: + + # -- (duration) Prometheus scrape timeout. + scrapeTimeout: + + # -- Labels to be added to the ServiceMonitor. + ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#prometheusspec + labels: {} + + # -- Annotations to be added to the ServiceMonitor. + ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#prometheusspec + annotations: {} + + # -- HTTP scheme to use for scraping. + # Can be used with `tlsConfig` for example if using istio mTLS. + scheme: "" + + # -- TLS configuration to use when scraping the endpoint. + # For example if using istio mTLS. + ## Of type: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#tlsconfig + tlsConfig: {} + + # -- Prometheus scrape bearerTokenFile + bearerTokenFile: + + # -- Prometheus scrape metric relabel configs + # to apply to samples before ingestion. + ## [Metric Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs) + metricRelabelings: [] + # - action: keep + # regex: 'kube_(daemonset|deployment|pod|namespace|node|statefulset).+' + # sourceLabels: [__name__] + + # -- Relabel configs to apply + # to samples before ingestion. + ## [Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config) + relabelings: [] + # - sourceLabels: [__meta_kubernetes_pod_node_name] + # separator: ; + # regex: ^(.*)$ + # targetLabel: nodename + # replacement: $1 + # action: replace + +# -- Container resource [requests and limits](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/). +# See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources) for details. +# @default -- No requests or limits. +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + +# -- Autoscaling configuration (see [values.yaml](values.yaml) for details). +# @default -- Disabled by default. +autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 100 + targetCPUUtilizationPercentage: 80 + # targetMemoryUtilizationPercentage: 80 + +# -- [Node selector](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector) configuration. +nodeSelector: {} + +# -- [Tolerations](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) for node taints. +# See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling) for details. +tolerations: [] + +# -- [Affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) configuration. +# See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling) for details. +affinity: {} + +# -- [TopologySpreadConstraints](https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/) configuration. +# See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling) for details. +topologySpreadConstraints: [] + +# -- Deployment [strategy](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy) configuration. +strategy: {} + # rollingUpdate: + # maxUnavailable: 1 + # type: RollingUpdate + +networkPolicy: + # -- Create [Network Policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/) + enabled: false + # -- A list of network policy egress rules + egressRules: [] + # Allow DNS egress traffic + # - ports: + # - port: 53 + # protocol: UDP + # - port: 53 + # protocol: TCP + # Example to allow LDAP connector to reach LDAPs port on 1.2.3.4 server + # - to: + # - ipBlock + # cidr: 1.2.3.4/32 + # ports: + # - port: 636 + # protocol: TCP diff --git a/charts/epinio/102.0.4+up1.9.0/charts/kubed/.helmignore b/charts/epinio/102.0.4+up1.9.0/charts/kubed/.helmignore new file mode 100644 index 000000000..be86b789d --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/kubed/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +# Helm files +OWNERS diff --git a/charts/epinio/102.0.4+up1.9.0/charts/kubed/Chart.yaml b/charts/epinio/102.0.4+up1.9.0/charts/kubed/Chart.yaml new file mode 100644 index 000000000..b01e55e5e --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/kubed/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +appVersion: v0.13.2 +description: Config Syncer by AppsCode - Kubernetes daemon +home: https://github.com/kubeops/config-syncer +icon: https://cdn.appscode.com/images/products/kubed/icons/android-icon-192x192.png +maintainers: +- email: support@appscode.com + name: appscode +name: kubed +sources: +- https://github.com/kubeops/config-syncer +version: v0.13.2 diff --git a/charts/epinio/102.0.4+up1.9.0/charts/kubed/README.md b/charts/epinio/102.0.4+up1.9.0/charts/kubed/README.md new file mode 100644 index 000000000..d747c5176 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/kubed/README.md @@ -0,0 +1,94 @@ +# Config Syncer + +[Config Syncer by AppsCode](https://github.com/kubeops/config-syncer) - A Kubernetes cluster manager daemon + +## TL;DR; + +```console +$ helm repo add appscode https://charts.appscode.com/stable/ +$ helm repo update +$ helm install kubed appscode/kubed -n kube-system +``` + +## Introduction + +This chart deploys a Config Syncer operator on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. + +## Prerequisites + +- Kubernetes 1.11+ + +## Installing the Chart + +To install the chart with the release name `kubed`: + +```console +$ helm install kubed appscode/kubed -n kube-system +``` + +The command deploys a Config Syncer operator on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation. + +> **Tip**: List all releases using `helm list` + +## Uninstalling the Chart + +To uninstall/delete the `kubed`: + +```console +$ helm delete kubed -n kube-system +``` + +The command removes all the Kubernetes components associated with the chart and deletes the release. + +## Configuration + +The following table lists the configurable parameters of the `kubed` chart and their default values. + +| Parameter | Description | Default | +|--------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------| +| nameOverride | Overrides name template | "" | +| fullnameOverride | Overrides fullname template | "" | +| replicaCount | Number of Config Syncer operator replicas to create (only 1 is supported) | 1 | +| operator.registry | Docker registry used to pull Config Syncer operator image | appscode | +| operator.repository | Config Syncer operator container image | kubed | +| operator.tag | Config Syncer operator container image tag | v0.13.2 | +| operator.resources | Compute Resources required by the operator container | {} | +| operator.securityContext | Security options the operator container should run with | {} | +| imagePullSecrets | Specify an array of imagePullSecrets. Secrets must be manually created in the namespace.
Example:
`helm template charts/kubed \`
`--set imagePullSecrets[0].name=sec0 \`
`--set imagePullSecrets[1].name=sec1` | [] | +| imagePullPolicy | Container image pull policy | IfNotPresent | +| criticalAddon | If true, installs Config Syncer operator as critical addon | false | +| logLevel | Log level for operator | 3 | +| annotations | Annotations applied to operator deployment | {} | +| podAnnotations | Annotations passed to operator pod(s). | {} | +| nodeSelector | Node labels for pod assignment | {} | +| tolerations | Tolerations for pod assignment | [] | +| affinity | Affinity rules for pod assignment | {} | +| podSecurityContext | Security options the operator pod should run with. | {"fsGroup":65535} | +| serviceAccount.create | Specifies whether a service account should be created | true | +| serviceAccount.annotations | Annotations to add to the service account | {} | +| serviceAccount.name | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | "" | +| apiserver.securePort | Port used by Config Syncer server | "8443" | +| apiserver.useKubeapiserverFqdnForAks | If true, uses kube-apiserver FQDN for AKS cluster to workaround https://github.com/Azure/AKS/issues/522 (default true) | true | +| apiserver.healthcheck.enabled | healthcheck configures the readiness and liveliness probes for the operator pod. | false | +| apiserver.servingCerts.generate | If true, generates on install/upgrade the certs that allow the kube-apiserver (and potentially ServiceMonitor) to authenticate operators pods. Otherwise specify certs in `apiserver.servingCerts.{caCrt, serverCrt, serverKey}`. | true | +| apiserver.servingCerts.caCrt | CA certficate used by serving certificate of Config Syncer server. | "" | +| apiserver.servingCerts.serverCrt | Serving certficate used by Config Syncer server. | "" | +| apiserver.servingCerts.serverKey | Private key for the serving certificate used by Config Syncer server. | "" | +| enableAnalytics | If true, sends usage analytics | true | +| config.clusterName | Set cluster-name to something meaningful to you, say, prod, prod-us-east, qa, etc. so that you can distinguish notifications sent by kubed | unicorn | +| config.configSourceNamespace | If set, configmaps and secrets from only this namespace will be synced | "" | +| config.kubeconfigContent | kubeconfig file content for configmap and secret syncer | "" | + + +Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example: + +```console +$ helm install kubed appscode/kubed -n kube-system --set replicaCount=1 +``` + +Alternatively, a YAML file that specifies the values for the parameters can be provided while +installing the chart. For example: + +```console +$ helm install kubed appscode/kubed -n kube-system --values values.yaml +``` diff --git a/charts/epinio/102.0.4+up1.9.0/charts/kubed/doc.yaml b/charts/epinio/102.0.4+up1.9.0/charts/kubed/doc.yaml new file mode 100644 index 000000000..e3b2d7fae --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/kubed/doc.yaml @@ -0,0 +1,18 @@ +project: + name: Config Syncer by AppsCode + shortName: Config Syncer + url: https://github.com/kubeops/config-syncer + description: A Kubernetes cluster manager daemon + app: a Config Syncer operator +repository: + url: https://charts.appscode.com/stable/ + name: appscode +chart: + name: kubed + values: "-- generate from values file --" + valuesExample: "-- generate from values file --" +prerequisites: +- Kubernetes 1.11+ +release: + name: kubed + namespace: kube-system diff --git a/charts/epinio/102.0.4+up1.9.0/charts/kubed/templates/NOTES.txt b/charts/epinio/102.0.4+up1.9.0/charts/kubed/templates/NOTES.txt new file mode 100644 index 000000000..aa9281fa0 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/kubed/templates/NOTES.txt @@ -0,0 +1,3 @@ +To verify that Config Syncer has started, run: + + kubectl get deployment --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "kubed.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" diff --git a/charts/epinio/102.0.4+up1.9.0/charts/kubed/templates/_helpers.tpl b/charts/epinio/102.0.4+up1.9.0/charts/kubed/templates/_helpers.tpl new file mode 100644 index 000000000..cbdcb8c0d --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/kubed/templates/_helpers.tpl @@ -0,0 +1,93 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "kubed.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "kubed.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "kubed.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "kubed.labels" -}} +helm.sh/chart: {{ include "kubed.chart" . }} +{{ include "kubed.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "kubed.selectorLabels" -}} +app.kubernetes.io/name: {{ include "kubed.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "kubed.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "kubed.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{/* +Windows cluster will add default taint for linux nodes, add below linux tolerations to +workloads could be scheduled to those linux nodes +*/}} +{{- define "linux-node-tolerations" -}} +- key: "cattle.io/os" + value: "linux" + effect: "NoSchedule" + operator: "Equal" +{{- end -}} + +{{- define "linux-node-selector" -}} +{{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}} +beta.kubernetes.io/os: linux +{{- else -}} +kubernetes.io/os: linux +{{- end -}} +{{- end -}} + +{{/* +URL prefix for container images to be compatible with Rancher +*/}} +{{- define "registry-url" -}} +{{- if .Values.global.cattle.systemDefaultRegistry -}} +{{ trimSuffix "/" .Values.global.cattle.systemDefaultRegistry }}/ +{{- else -}} +{{ .Values.operator.registry }}/ +{{- end -}} +{{- end -}} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/kubed/templates/apiregistration.yaml b/charts/epinio/102.0.4+up1.9.0/charts/kubed/templates/apiregistration.yaml new file mode 100644 index 000000000..fcbf02a36 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/kubed/templates/apiregistration.yaml @@ -0,0 +1,58 @@ +{{- $serverCrt := "" }} +{{- $serverKey := "" }} +{{- if .Values.apiserver.servingCerts.generate }} +{{- $ca := genCA "ca" 3650 }} +{{- $cn := include "kubed.fullname" . -}} +{{- $altName1 := printf "%s.%s" $cn .Release.Namespace }} +{{- $altName2 := printf "%s.%s.svc" $cn .Release.Namespace }} +{{- $server := genSignedCert $cn nil (list $altName1 $altName2) 3650 $ca }} +{{- $serverCrt = b64enc $server.Cert }} +{{- $serverKey = b64enc $server.Key }} +{{- else }} +{{- $serverCrt = required "Required when apiserver.servingCerts.generate is false" .Values.apiserver.servingCerts.serverCrt }} +{{- $serverKey = required "Required when apiserver.servingCerts.generate is false" .Values.apiserver.servingCerts.serverKey }} +{{- end }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "kubed.fullname" . }}-apiserver-cert + namespace: {{ .Release.Namespace }} + labels: + {{- include "kubed.labels" . | nindent 4 }} +type: Opaque +data: + tls.crt: {{ $serverCrt }} + tls.key: {{ $serverKey }} +--- +# to read the config for terminating authentication +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ template "kubed.fullname" . }}-apiserver-extension-server-authentication-reader + namespace: kube-system + labels: + {{- include "kubed.labels" . | nindent 4 }} +roleRef: + kind: Role + apiGroup: rbac.authorization.k8s.io + name: extension-apiserver-authentication-reader +subjects: +- kind: ServiceAccount + name: {{ template "kubed.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +--- +# to delegate authentication and authorization +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "kubed.fullname" . }}-apiserver-auth-delegator + labels: + {{- include "kubed.labels" . | nindent 4 }} +roleRef: + kind: ClusterRole + apiGroup: rbac.authorization.k8s.io + name: system:auth-delegator +subjects: +- kind: ServiceAccount + name: {{ template "kubed.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/kubed/templates/cluster-role-binding.yaml b/charts/epinio/102.0.4+up1.9.0/charts/kubed/templates/cluster-role-binding.yaml new file mode 100644 index 000000000..8ea05646a --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/kubed/templates/cluster-role-binding.yaml @@ -0,0 +1,14 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "kubed.fullname" . }} + labels: + {{- include "kubed.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "kubed.fullname" . }} +subjects: +- kind: ServiceAccount + name: {{ template "kubed.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/kubed/templates/cluster-role.yaml b/charts/epinio/102.0.4+up1.9.0/charts/kubed/templates/cluster-role.yaml new file mode 100644 index 000000000..95e014790 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/kubed/templates/cluster-role.yaml @@ -0,0 +1,24 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "kubed.fullname" . }} + labels: + {{- include "kubed.labels" . | nindent 4 }} +rules: +- apiGroups: [""] + resources: + - configmaps + - secrets + verbs: ["get", "create", "patch", "delete", "list", "watch"] +- apiGroups: [""] + resources: + - namespaces + verbs: ["get", "list", "watch"] +- apiGroups: [""] + resources: + - nodes + verbs: ["list"] +- apiGroups: [""] + resources: + - events + verbs: ["create"] diff --git a/charts/epinio/102.0.4+up1.9.0/charts/kubed/templates/deployment.yaml b/charts/epinio/102.0.4+up1.9.0/charts/kubed/templates/deployment.yaml new file mode 100644 index 000000000..77efce771 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/kubed/templates/deployment.yaml @@ -0,0 +1,119 @@ +{{- $major := default "0" .Capabilities.KubeVersion.Major | trimSuffix "+" | int64 }} +{{- $minor := default "0" .Capabilities.KubeVersion.Minor | trimSuffix "+" | int64 }} +{{- $criticalAddon := and .Values.criticalAddon (or (eq .Release.Namespace "kube-system") (and (ge $major 1) (ge $minor 17))) -}} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "kubed.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "kubed.labels" . | nindent 4 }} + {{- with .Values.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + replicas: {{ .Values.replicaCount }} + selector: + matchLabels: + {{- include "kubed.selectorLabels" . | nindent 6 }} + template: + metadata: + labels: + {{- include "kubed.selectorLabels" . | nindent 8 }} + annotations: + checksum/apiregistration.yaml: {{ include (print $.Template.BasePath "/apiregistration.yaml") . | sha256sum }} + {{- if $criticalAddon }} + scheduler.alpha.kubernetes.io/critical-pod: '' + {{- end }} + {{- with .Values.podAnnotations }} + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "kubed.serviceAccountName" . }} + containers: + - name: kubed + securityContext: + {{- toYaml .Values.operator.securityContext | nindent 10 }} + image: {{ template "registry-url" . }}{{ .Values.operator.repository }}:{{ .Values.operator.tag }} + imagePullPolicy: {{ .Values.imagePullPolicy }} + args: + - run + - --v={{ .Values.logLevel }} + - --secure-port={{ default "8443" .Values.apiserver.securePort }} + - --audit-log-path=- + - --tls-cert-file=/var/serving-cert/tls.crt + - --tls-private-key-file=/var/serving-cert/tls.key + - --use-kubeapiserver-fqdn-for-aks={{ .Values.apiserver.useKubeapiserverFqdnForAks }} + - --enable-analytics={{ .Values.enableAnalytics }} + {{- with .Values.config.clusterName }} + - --cluster-name={{ . }} + {{- end }} + {{- with .Values.config.configSourceNamespace }} + - --config-source-namespace={{ . }} + {{- end }} + {{- if .Values.config.kubeconfigContent }} + - --kubeconfig-file=/srv/kubed/kubeconfig + {{- end }} + {{- range .Values.config.additionalOptions }} + - {{ . }} + {{- end }} + ports: + - containerPort: {{ default "8443" .Values.apiserver.securePort }} + {{- if .Values.apiserver.healthcheck.enabled }} + readinessProbe: + httpGet: + path: /healthz + port: {{ default "8443" .Values.apiserver.securePort }} + scheme: HTTPS + initialDelaySeconds: 5 + livenessProbe: + httpGet: + path: /healthz + port: {{ default "8443" .Values.apiserver.securePort }} + scheme: HTTPS + initialDelaySeconds: 5 + {{- end }} + resources: + {{- toYaml .Values.operator.resources | nindent 10 }} + volumeMounts: + - name: config + mountPath: /srv/kubed + - name: scratch + mountPath: /tmp + - mountPath: /var/serving-cert + name: serving-cert + volumes: + - name: config + secret: + secretName: {{ template "kubed.fullname" . }} + - name: scratch + emptyDir: {} + - name: serving-cert + secret: + defaultMode: 420 + secretName: {{ template "kubed.fullname" . }}-apiserver-cert + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + tolerations: + {{- include "linux-node-tolerations" . | nindent 8 }} + {{- with .Values.tolerations }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if $criticalAddon }} + - key: CriticalAddonsOnly + operator: Exists + {{- end -}} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + nodeSelector: + {{- include "linux-node-selector" . | nindent 8 }} + {{- if $criticalAddon }} + priorityClassName: system-cluster-critical + {{- end -}} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/kubed/templates/psp.yaml b/charts/epinio/102.0.4+up1.9.0/charts/kubed/templates/psp.yaml new file mode 100644 index 000000000..a9d936fd5 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/kubed/templates/psp.yaml @@ -0,0 +1,86 @@ +{{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy" -}} +{{- if .Values.serviceAccount.create }} +{{- if .Values.global.rbac.pspEnabled }} + +--- +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: {{ include "kubed.serviceAccountName" . }}-psp + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: "{{ replace "+" "_" .Chart.Version }}" + app.kubernetes.io/part-of: {{ include "kubed.serviceAccountName" . }} + app: {{ include "kubed.serviceAccountName" . }} +{{- if .Values.global.rbac.pspAnnotations }} + annotations: {{ toYaml .Values.global.rbac.pspAnnotations | nindent 4 }} +{{- end }} +spec: + privileged: false + hostNetwork: false + hostIPC: false + hostPID: false + runAsUser: + # Permits the container to run with root privileges as well. + rule: 'RunAsAny' + seLinux: + # This policy assumes the nodes are using AppArmor rather than SELinux. + rule: 'RunAsAny' + supplementalGroups: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 0 + max: 65535 + fsGroup: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 0 + max: 65535 + readOnlyRootFilesystem: false + +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "kubed.serviceAccountName" . }}-psp + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: "{{ replace "+" "_" .Chart.Version }}" + app.kubernetes.io/part-of: {{ include "kubed.serviceAccountName" . }} + app: {{ include "kubed.serviceAccountName" . }} +rules: +{{- if semverCompare "> 1.15.0-0" .Capabilities.KubeVersion.GitVersion }} +- apiGroups: ['policy'] +{{- else }} +- apiGroups: ['extensions'] +{{- end }} + resources: ['podsecuritypolicies'] + verbs: ['use'] + resourceNames: + - {{ include "kubed.serviceAccountName" . }}-psp + +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "kubed.serviceAccountName" . }}-psp + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: "{{ replace "+" "_" .Chart.Version }}" + app.kubernetes.io/part-of: {{ include "kubed.serviceAccountName" . }} + app: {{ include "kubed.serviceAccountName" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "kubed.serviceAccountName" . }}-psp +subjects: + - kind: ServiceAccount + name: {{ include "kubed.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} + +{{- end }} +{{- end }} +{{- end -}} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/kubed/templates/secret.yaml b/charts/epinio/102.0.4+up1.9.0/charts/kubed/templates/secret.yaml new file mode 100644 index 000000000..a980ae34b --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/kubed/templates/secret.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "kubed.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "kubed.labels" . | nindent 4 }} +data: + {{- if .Values.config.kubeconfigContent }} + kubeconfig: {{ .Values.config.kubeconfigContent | trim | b64enc | quote }} + {{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/kubed/templates/service.yaml b/charts/epinio/102.0.4+up1.9.0/charts/kubed/templates/service.yaml new file mode 100644 index 000000000..95b76cf64 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/kubed/templates/service.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ template "kubed.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "kubed.labels" . | nindent 4 }} +spec: + ports: + # Port used to expose admission webhook apiserver + - name: api + port: 443 + targetPort: {{ default "8443" .Values.apiserver.securePort }} + selector: + {{- include "kubed.selectorLabels" . | nindent 4 }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/kubed/templates/serviceaccount.yaml b/charts/epinio/102.0.4+up1.9.0/charts/kubed/templates/serviceaccount.yaml new file mode 100644 index 000000000..96f9c84c1 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/kubed/templates/serviceaccount.yaml @@ -0,0 +1,13 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "kubed.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "kubed.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end -}} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/kubed/values.yaml b/charts/epinio/102.0.4+up1.9.0/charts/kubed/values.yaml new file mode 100644 index 000000000..0be091855 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/kubed/values.yaml @@ -0,0 +1,101 @@ +# Default values for kubed. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +# Overrides name template +nameOverride: "" +# Overrides fullname template +fullnameOverride: "" + +# Number of Config Syncer operator replicas to create (only 1 is supported) +replicaCount: 1 + +operator: + # Config Syncer operator container image + repository: rancher/mirrored-appscode-kubed + # Config Syncer operator container image tag + tag: v0.13.2 + # Compute Resources required by the operator container + resources: {} + # Security options the operator container should run with + securityContext: {} + +# Specify an array of imagePullSecrets. +# Secrets must be manually created in the namespace. +# +# Example: +# helm template charts/kubed \ +# --set imagePullSecrets[0].name=sec0 \ +# --set imagePullSecrets[1].name=sec1 +imagePullSecrets: [] + +# Container image pull policy +imagePullPolicy: IfNotPresent + +# If true, installs Config Syncer operator as critical addon +criticalAddon: false + +# Log level for operator +logLevel: 3 + +# Annotations applied to operator deployment +annotations: {} + +# Annotations passed to operator pod(s). +podAnnotations: {} + +# Node labels for pod assignment +nodeSelector: {} + +# Tolerations for pod assignment +tolerations: [] + +# Affinity rules for pod assignment +affinity: {} + +# Security options the operator pod should run with. +podSecurityContext: # +doc-gen:break + # ensure that s/a token is readable xref: https://issues.k8s.io/70679 + fsGroup: 65535 + +serviceAccount: + # Specifies whether a service account should be created + create: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + +apiserver: + # Port used by Config Syncer server + securePort: "8443" + # If true, uses kube-apiserver FQDN for AKS cluster to workaround https://github.com/Azure/AKS/issues/522 (default true) + useKubeapiserverFqdnForAks: true + healthcheck: + # healthcheck configures the readiness and liveliness probes for the operator pod. + enabled: false + servingCerts: + # If true, generates on install/upgrade the certs that allow the kube-apiserver (and potentially ServiceMonitor) + # to authenticate operators pods. Otherwise specify certs in `apiserver.servingCerts.{caCrt, serverCrt, serverKey}`. + generate: true + # CA certficate used by serving certificate of Config Syncer server. + caCrt: "" + # Serving certficate used by Config Syncer server. + serverCrt: "" + # Private key for the serving certificate used by Config Syncer server. + serverKey: "" + +# If true, sends usage analytics +enableAnalytics: true + +config: + # Set cluster-name to something meaningful to you, say, prod, prod-us-east, qa, etc. + # so that you can distinguish notifications sent by kubed + clusterName: unicorn + # If set, configmaps and secrets from only this namespace will be synced + configSourceNamespace: "" + # kubeconfig file content for configmap and secret syncer + kubeconfigContent: "" +# additionalOptions: +# - --authentication-skip-lookup diff --git a/charts/epinio/102.0.4+up1.9.0/charts/minio/.helmignore b/charts/epinio/102.0.4+up1.9.0/charts/minio/.helmignore new file mode 100644 index 000000000..a9fe72788 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/minio/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +# OWNERS file for Kubernetes +OWNERS \ No newline at end of file diff --git a/charts/epinio/102.0.4+up1.9.0/charts/minio/Chart.yaml b/charts/epinio/102.0.4+up1.9.0/charts/minio/Chart.yaml new file mode 100644 index 000000000..29c7fbc4e --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/minio/Chart.yaml @@ -0,0 +1,18 @@ +apiVersion: v1 +appVersion: RELEASE.2023-07-07T07-13-57Z +description: Multi-Cloud Object Storage +home: https://min.io +icon: https://min.io/resources/img/logo/MINIO_wordmark.png +keywords: +- minio +- storage +- object-storage +- s3 +- cluster +maintainers: +- email: dev@minio.io + name: MinIO, Inc +name: minio +sources: +- https://github.com/minio/minio +version: 5.0.13 diff --git a/charts/epinio/102.0.4+up1.9.0/charts/minio/README.md b/charts/epinio/102.0.4+up1.9.0/charts/minio/README.md new file mode 100644 index 000000000..6de4fb16b --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/minio/README.md @@ -0,0 +1,260 @@ +# MinIO Helm Chart + +[![Slack](https://slack.min.io/slack?type=svg)](https://slack.min.io) [![license](https://img.shields.io/badge/license-AGPL%20V3-blue)](https://github.com/minio/minio/blob/master/LICENSE) + +MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. It is API compatible with Amazon S3 cloud storage service. Use MinIO to build high performance infrastructure for machine learning, analytics and application data workloads. + +For more detailed documentation please visit [here](https://min.io/docs/minio/linux/index.html) + +## Introduction + +This chart bootstraps MinIO Cluster on [Kubernetes](http://kubernetes.io) using the [Helm](https://helm.sh) package manager. + +## Prerequisites + +- Helm cli with Kubernetes cluster configured. +- PV provisioner support in the underlying infrastructure. (We recommend using ) +- Use Kubernetes version v1.19 and later for best experience. + +## Configure MinIO Helm repo + +```bash +helm repo add minio https://charts.min.io/ +``` + +### Installing the Chart + +Install this chart using: + +```bash +helm install --namespace minio --set rootUser=rootuser,rootPassword=rootpass123 --generate-name minio/minio +``` + +The command deploys MinIO on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation. + +### Installing the Chart (toy-setup) + +Minimal toy setup for testing purposes can be deployed using: + +```bash +helm install --set resources.requests.memory=512Mi --set replicas=1 --set persistence.enabled=false --set mode=standalone --set rootUser=rootuser,rootPassword=rootpass123 --generate-name minio/minio +``` + +### Upgrading the Chart + +You can use Helm to update MinIO version in a live release. Assuming your release is named as `my-release`, get the values using the command: + +```bash +helm get values my-release > old_values.yaml +``` + +Then change the field `image.tag` in `old_values.yaml` file with MinIO image tag you want to use. Now update the chart using + +```bash +helm upgrade -f old_values.yaml my-release minio/minio +``` + +Default upgrade strategies are specified in the `values.yaml` file. Update these fields if you'd like to use a different strategy. + +### Configuration + +Refer the [Values file](./values.yaml) for all the possible config fields. + +You can specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, + +```bash +helm install --name my-release --set persistence.size=1Ti minio/minio +``` + +The above command deploys MinIO server with a 1Ti backing persistent volume. + +Alternately, you can provide a YAML file that specifies parameter values while installing the chart. For example, + +```bash +helm install --name my-release -f values.yaml minio/minio +``` + +### Persistence + +This chart provisions a PersistentVolumeClaim and mounts corresponding persistent volume to default location `/export`. You'll need physical storage available in the Kubernetes cluster for this to work. If you'd rather use `emptyDir`, disable PersistentVolumeClaim by: + +```bash +helm install --set persistence.enabled=false minio/minio +``` + +> *"An emptyDir volume is first created when a Pod is assigned to a Node, and exists as long as that Pod is running on that node. When a Pod is removed from a node for any reason, the data in the emptyDir is deleted forever."* + +### Existing PersistentVolumeClaim + +If a Persistent Volume Claim already exists, specify it during installation. + +1. Create the PersistentVolume +2. Create the PersistentVolumeClaim +3. Install the chart + +```bash +helm install --set persistence.existingClaim=PVC_NAME minio/minio +``` + +### NetworkPolicy + +To enable network policy for MinIO, +install [a networking plugin that implements the Kubernetes +NetworkPolicy spec](https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy#before-you-begin), +and set `networkPolicy.enabled` to `true`. + +For Kubernetes v1.5 & v1.6, you must also turn on NetworkPolicy by setting +the DefaultDeny namespace annotation. Note: this will enforce policy for *all* pods in the namespace: + +``` +kubectl annotate namespace default "net.beta.kubernetes.io/network-policy={\"ingress\":{\"isolation\":\"DefaultDeny\"}}" +``` + +With NetworkPolicy enabled, traffic will be limited to just port 9000. + +For more precise policy, set `networkPolicy.allowExternal=true`. This will +only allow pods with the generated client label to connect to MinIO. +This label will be displayed in the output of a successful install. + +### Existing secret + +Instead of having this chart create the secret for you, you can supply a preexisting secret, much +like an existing PersistentVolumeClaim. + +First, create the secret: + +```bash +kubectl create secret generic my-minio-secret --from-literal=rootUser=foobarbaz --from-literal=rootPassword=foobarbazqux +``` + +Then install the chart, specifying that you want to use an existing secret: + +```bash +helm install --set existingSecret=my-minio-secret minio/minio +``` + +The following fields are expected in the secret: + +| .data.\ in Secret | Corresponding variable | Description | Required | +|:------------------------|:-----------------------|:---------------|:---------| +| `rootUser` | `rootUser` | Root user. | yes | +| `rootPassword` | `rootPassword` | Root password. | yes | + +All corresponding variables will be ignored in values file. + +### Configure TLS + +To enable TLS for MinIO containers, acquire TLS certificates from a CA or create self-signed certificates. While creating / acquiring certificates ensure the corresponding domain names are set as per the standard [DNS naming conventions](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-identity) in a Kubernetes StatefulSet (for a distributed MinIO setup). Then create a secret using + +```bash +kubectl create secret generic tls-ssl-minio --from-file=path/to/private.key --from-file=path/to/public.crt +``` + +Then install the chart, specifying that you want to use the TLS secret: + +```bash +helm install --set tls.enabled=true,tls.certSecret=tls-ssl-minio minio/minio +``` + +### Installing certificates from third party CAs + +MinIO can connect to other servers, including MinIO nodes or other server types such as NATs and Redis. If these servers use certificates that were not registered with a known CA, add trust for these certificates to MinIO Server by bundling these certificates into a Kubernetes secret and providing it to Helm via the `trustedCertsSecret` value. If `.Values.tls.enabled` is `true` and you're installing certificates for third party CAs, remember to include MinIO's own certificate with key `public.crt`, if it also needs to be trusted. + +For instance, given that TLS is enabled and you need to add trust for MinIO's own CA and for the CA of a Keycloak server, a Kubernetes secret can be created from the certificate files using `kubectl`: + +``` +kubectl -n minio create secret generic minio-trusted-certs --from-file=public.crt --from-file=keycloak.crt +``` + +If TLS is not enabled, you would need only the third party CA: + +``` +kubectl -n minio create secret generic minio-trusted-certs --from-file=keycloak.crt +``` + +The name of the generated secret can then be passed to Helm using a values file or the `--set` parameter: + +``` +trustedCertsSecret: "minio-trusted-certs" + +or + +--set trustedCertsSecret=minio-trusted-certs +``` + +### Create buckets after install + +Install the chart, specifying the buckets you want to create after install: + +```bash +helm install --set buckets[0].name=bucket1,buckets[0].policy=none,buckets[0].purge=false minio/minio +``` + +Description of the configuration parameters used above - + +- `buckets[].name` - name of the bucket to create, must be a string with length > 0 +- `buckets[].policy` - can be one of none|download|upload|public +- `buckets[].purge` - purge if bucket exists already + +### Create policies after install + +Install the chart, specifying the policies you want to create after install: + +```bash +helm install --set policies[0].name=mypolicy,policies[0].statements[0].resources[0]='arn:aws:s3:::bucket1',policies[0].statements[0].actions[0]='s3:ListBucket',policies[0].statements[0].actions[1]='s3:GetObject' minio/minio +``` + +Description of the configuration parameters used above - + +- `policies[].name` - name of the policy to create, must be a string with length > 0 +- `policies[].statements[]` - list of statements, includes actions and resources +- `policies[].statements[].resources[]` - list of resources that applies the statement +- `policies[].statements[].actions[]` - list of actions granted + +### Create user after install + +Install the chart, specifying the users you want to create after install: + +```bash +helm install --set users[0].accessKey=accessKey,users[0].secretKey=secretKey,users[0].policy=none,users[1].accessKey=accessKey2,users[1].secretRef=existingSecret,users[1].secretKey=password,users[1].policy=none minio/minio +``` + +Description of the configuration parameters used above - + +- `users[].accessKey` - accessKey of user +- `users[].secretKey` - secretKey of usersecretRef +- `users[].existingSecret` - secret name that contains the secretKey of user +- `users[].existingSecretKey` - data key in existingSecret secret containing the secretKey +- `users[].policy` - name of the policy to assign to user + +### Create service account after install + +Install the chart, specifying the service accounts you want to create after install: + +```bash +helm install --set svcaccts[0].accessKey=accessKey,svcaccts[0].secretKey=secretKey,svcaccts[0].user=parentUser,svcaccts[1].accessKey=accessKey2,svcaccts[1].secretRef=existingSecret,svcaccts[1].secretKey=password,svcaccts[1].user=parentUser2 minio/minio +``` + +Description of the configuration parameters used above - + +- `svcaccts[].accessKey` - accessKey of service account +- `svcaccts[].secretKey` - secretKey of svcacctsecretRef +- `svcaccts[].existingSecret` - secret name that contains the secretKey of service account +- `svcaccts[].existingSecretKey` - data key in existingSecret secret containing the secretKey +- `svcaccts[].user` - name of the parent user to assign to service account + +## Uninstalling the Chart + +Assuming your release is named as `my-release`, delete it using the command: + +```bash +helm delete my-release +``` + +or + +```bash +helm uninstall my-release +``` + +The command removes all the Kubernetes components associated with the chart and deletes the release. diff --git a/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/NOTES.txt b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/NOTES.txt new file mode 100644 index 000000000..7051b1e62 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/NOTES.txt @@ -0,0 +1,43 @@ +{{- if eq .Values.service.type "ClusterIP" "NodePort" }} +MinIO can be accessed via port {{ .Values.service.port }} on the following DNS name from within your cluster: +{{ template "minio.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local + +To access MinIO from localhost, run the below commands: + + 1. export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") + + 2. kubectl port-forward $POD_NAME 9000 --namespace {{ .Release.Namespace }} + +Read more about port forwarding here: http://kubernetes.io/docs/user-guide/kubectl/kubectl_port-forward/ + +You can now access MinIO server on http://localhost:9000. Follow the below steps to connect to MinIO server with mc client: + + 1. Download the MinIO mc client - https://min.io/docs/minio/linux/reference/minio-mc.html#quickstart + + 2. export MC_HOST_{{ template "minio.fullname" . }}-local=http://$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "minio.secretName" . }} -o jsonpath="{.data.rootUser}" | base64 --decode):$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "minio.secretName" . }} -o jsonpath="{.data.rootPassword}" | base64 --decode)@localhost:{{ .Values.service.port }} + + 3. mc ls {{ template "minio.fullname" . }}-local + +{{- end }} +{{- if eq .Values.service.type "LoadBalancer" }} +MinIO can be accessed via port {{ .Values.service.port }} on an external IP address. Get the service external IP address by: +kubectl get svc --namespace {{ .Release.Namespace }} -l app={{ template "minio.fullname" . }} + +Note that the public IP may take a couple of minutes to be available. + +You can now access MinIO server on http://:9000. Follow the below steps to connect to MinIO server with mc client: + + 1. Download the MinIO mc client - https://min.io/docs/minio/linux/reference/minio-mc.html#quickstart + + 2. export MC_HOST_{{ template "minio.fullname" . }}-local=http://$(kubectl get secret {{ template "minio.secretName" . }} --namespace {{ .Release.Namespace }} -o jsonpath="{.data.rootUser}" | base64 --decode):$(kubectl get secret {{ template "minio.secretName" . }} -o jsonpath="{.data.rootPassword}" | base64 --decode)@:{{ .Values.service.port }} + + 3. mc ls {{ template "minio.fullname" . }} + +Alternately, you can use your browser or the MinIO SDK to access the server - https://min.io/docs/minio/linux/reference/minio-server/minio-server.html +{{- end }} + +{{ if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }} +Note: Since NetworkPolicy is enabled, only pods with label +{{ template "minio.fullname" . }}-client=true" +will be able to connect to this minio cluster. +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/_helper_create_bucket.txt b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/_helper_create_bucket.txt new file mode 100644 index 000000000..ea29f334a --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/_helper_create_bucket.txt @@ -0,0 +1,123 @@ +#!/bin/sh +set -e ; # Have script exit in the event of a failed command. + +{{- if .Values.configPathmc }} +MC_CONFIG_DIR="{{ .Values.configPathmc }}" +MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}" +{{- else }} +MC="/usr/bin/mc --insecure" +{{- end }} + +# connectToMinio +# Use a check-sleep-check loop to wait for MinIO service to be available +connectToMinio() { + SCHEME=$1 + ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts + set -e ; # fail if we can't read the keys. + ACCESS=$(cat /config/rootUser) ; SECRET=$(cat /config/rootPassword) ; + set +e ; # The connections to minio are allowed to fail. + echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ; + MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ; + $MC_COMMAND ; + STATUS=$? ; + until [ $STATUS = 0 ] + do + ATTEMPTS=`expr $ATTEMPTS + 1` ; + echo \"Failed attempts: $ATTEMPTS\" ; + if [ $ATTEMPTS -gt $LIMIT ]; then + exit 1 ; + fi ; + sleep 2 ; # 1 second intervals between attempts + $MC_COMMAND ; + STATUS=$? ; + done ; + set -e ; # reset `e` as active + return 0 +} + +# checkBucketExists ($bucket) +# Check if the bucket exists, by using the exit code of `mc ls` +checkBucketExists() { + BUCKET=$1 + CMD=$(${MC} stat myminio/$BUCKET > /dev/null 2>&1) + return $? +} + +# createBucket ($bucket, $policy, $purge) +# Ensure bucket exists, purging if asked to +createBucket() { + BUCKET=$1 + POLICY=$2 + PURGE=$3 + VERSIONING=$4 + OBJECTLOCKING=$5 + + # Purge the bucket, if set & exists + # Since PURGE is user input, check explicitly for `true` + if [ $PURGE = true ]; then + if checkBucketExists $BUCKET ; then + echo "Purging bucket '$BUCKET'." + set +e ; # don't exit if this fails + ${MC} rm -r --force myminio/$BUCKET + set -e ; # reset `e` as active + else + echo "Bucket '$BUCKET' does not exist, skipping purge." + fi + fi + +# Create the bucket if it does not exist and set objectlocking if enabled (NOTE: versioning will be not changed if OBJECTLOCKING is set because it enables versioning to the Buckets created) +if ! checkBucketExists $BUCKET ; then + if [ ! -z $OBJECTLOCKING ] ; then + if [ $OBJECTLOCKING = true ] ; then + echo "Creating bucket with OBJECTLOCKING '$BUCKET'" + ${MC} mb --with-lock myminio/$BUCKET + elif [ $OBJECTLOCKING = false ] ; then + echo "Creating bucket '$BUCKET'" + ${MC} mb myminio/$BUCKET + fi + elif [ -z $OBJECTLOCKING ] ; then + echo "Creating bucket '$BUCKET'" + ${MC} mb myminio/$BUCKET + else + echo "Bucket '$BUCKET' already exists." + fi + fi + + + # set versioning for bucket if objectlocking is disabled or not set + if [ -z $OBJECTLOCKING ] ; then + if [ ! -z $VERSIONING ] ; then + if [ $VERSIONING = true ] ; then + echo "Enabling versioning for '$BUCKET'" + ${MC} version enable myminio/$BUCKET + elif [ $VERSIONING = false ] ; then + echo "Suspending versioning for '$BUCKET'" + ${MC} version suspend myminio/$BUCKET + fi + fi + else + echo "Bucket '$BUCKET' versioning unchanged." + fi + + + # At this point, the bucket should exist, skip checking for existence + # Set policy on the bucket + echo "Setting policy of bucket '$BUCKET' to '$POLICY'." + ${MC} anonymous set $POLICY myminio/$BUCKET +} + +# Try connecting to MinIO instance +{{- if .Values.tls.enabled }} +scheme=https +{{- else }} +scheme=http +{{- end }} +connectToMinio $scheme + +{{ if .Values.buckets }} +{{ $global := . }} +# Create the buckets +{{- range .Values.buckets }} +createBucket {{ tpl .name $global }} {{ .policy | default "none" | quote }} {{ .purge | default false }} {{ .versioning | default false }} {{ .objectlocking | default false }} +{{- end }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/_helper_create_policy.txt b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/_helper_create_policy.txt new file mode 100644 index 000000000..aa584952f --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/_helper_create_policy.txt @@ -0,0 +1,75 @@ +#!/bin/sh +set -e ; # Have script exit in the event of a failed command. + +{{- if .Values.configPathmc }} +MC_CONFIG_DIR="{{ .Values.configPathmc }}" +MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}" +{{- else }} +MC="/usr/bin/mc --insecure" +{{- end }} + +# connectToMinio +# Use a check-sleep-check loop to wait for MinIO service to be available +connectToMinio() { + SCHEME=$1 + ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts + set -e ; # fail if we can't read the keys. + ACCESS=$(cat /config/rootUser) ; SECRET=$(cat /config/rootPassword) ; + set +e ; # The connections to minio are allowed to fail. + echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ; + MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ; + $MC_COMMAND ; + STATUS=$? ; + until [ $STATUS = 0 ] + do + ATTEMPTS=`expr $ATTEMPTS + 1` ; + echo \"Failed attempts: $ATTEMPTS\" ; + if [ $ATTEMPTS -gt $LIMIT ]; then + exit 1 ; + fi ; + sleep 2 ; # 1 second intervals between attempts + $MC_COMMAND ; + STATUS=$? ; + done ; + set -e ; # reset `e` as active + return 0 +} + +# checkPolicyExists ($policy) +# Check if the policy exists, by using the exit code of `mc admin policy info` +checkPolicyExists() { + POLICY=$1 + CMD=$(${MC} admin policy info myminio $POLICY > /dev/null 2>&1) + return $? +} + +# createPolicy($name, $filename) +createPolicy () { + NAME=$1 + FILENAME=$2 + + # Create the name if it does not exist + echo "Checking policy: $NAME (in /config/$FILENAME.json)" + if ! checkPolicyExists $NAME ; then + echo "Creating policy '$NAME'" + else + echo "Policy '$NAME' already exists." + fi + ${MC} admin policy create myminio $NAME /config/$FILENAME.json + +} + +# Try connecting to MinIO instance +{{- if .Values.tls.enabled }} +scheme=https +{{- else }} +scheme=http +{{- end }} +connectToMinio $scheme + +{{ if .Values.policies }} +# Create the policies +{{- range $idx, $policy := .Values.policies }} +createPolicy {{ $policy.name }} policy_{{ $idx }} +{{- end }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/_helper_create_svcacct.txt b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/_helper_create_svcacct.txt new file mode 100644 index 000000000..59f51b177 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/_helper_create_svcacct.txt @@ -0,0 +1,106 @@ +#!/bin/sh +set -e ; # Have script exit in the event of a failed command. + +{{- if .Values.configPathmc }} +MC_CONFIG_DIR="{{ .Values.configPathmc }}" +MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}" +{{- else }} +MC="/usr/bin/mc --insecure" +{{- end }} + +# AccessKey and secretkey credentials file are added to prevent shell execution errors caused by special characters. +# Special characters for example : ',",<,>,{,} +MINIO_ACCESSKEY_SECRETKEY_TMP="/tmp/accessKey_and_secretKey_svcacct_tmp" + +# connectToMinio +# Use a check-sleep-check loop to wait for MinIO service to be available +connectToMinio() { + SCHEME=$1 + ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts + set -e ; # fail if we can't read the keys. + ACCESS=$(cat /config/rootUser) ; SECRET=$(cat /config/rootPassword) ; + set +e ; # The connections to minio are allowed to fail. + echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ; + MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ; + $MC_COMMAND ; + STATUS=$? ; + until [ $STATUS = 0 ] + do + ATTEMPTS=`expr $ATTEMPTS + 1` ; + echo \"Failed attempts: $ATTEMPTS\" ; + if [ $ATTEMPTS -gt $LIMIT ]; then + exit 1 ; + fi ; + sleep 2 ; # 2 second intervals between attempts + $MC_COMMAND ; + STATUS=$? ; + done ; + set -e ; # reset `e` as active + return 0 +} + +# checkSvcacctExists () +# Check if the svcacct exists, by using the exit code of `mc admin user svcacct info` +checkSvcacctExists() { + CMD=$(${MC} admin user svcacct info myminio $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) > /dev/null 2>&1) + return $? +} + +# createSvcacct ($user) +createSvcacct () { + USER=$1 + FILENAME=$2 + #check accessKey_and_secretKey_tmp file + if [[ ! -f $MINIO_ACCESSKEY_SECRETKEY_TMP ]];then + echo "credentials file does not exist" + return 1 + fi + if [[ $(cat $MINIO_ACCESSKEY_SECRETKEY_TMP|wc -l) -ne 2 ]];then + echo "credentials file is invalid" + rm -f $MINIO_ACCESSKEY_SECRETKEY_TMP + return 1 + fi + SVCACCT=$(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) + # Create the svcacct if it does not exist + if ! checkSvcacctExists ; then + echo "Creating svcacct '$SVCACCT'" + # Check if policy file is define + if [ -z $FILENAME ]; then + ${MC} admin user svcacct add --access-key $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) --secret-key $(tail -n1 $MINIO_ACCESSKEY_SECRETKEY_TMP) myminio $USER + else + ${MC} admin user svcacct add --access-key $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) --secret-key $(tail -n1 $MINIO_ACCESSKEY_SECRETKEY_TMP) --policy /config/$FILENAME.json myminio $USER + fi + else + echo "Svcacct '$SVCACCT' already exists." + fi + #clean up credentials files. + rm -f $MINIO_ACCESSKEY_SECRETKEY_TMP +} + +# Try connecting to MinIO instance +{{- if .Values.tls.enabled }} +scheme=https +{{- else }} +scheme=http +{{- end }} +connectToMinio $scheme + +{{ if .Values.svcaccts }} +{{ $global := . }} +# Create the svcaccts +{{- range $idx, $svc := .Values.svcaccts }} +echo {{ tpl .accessKey $global }} > $MINIO_ACCESSKEY_SECRETKEY_TMP +{{- if .existingSecret }} +cat /config/secrets-svc/{{ tpl .existingSecret $global }}/{{ tpl .existingSecretKey $global }} >> $MINIO_ACCESSKEY_SECRETKEY_TMP +# Add a new line if it doesn't exist +sed -i '$a\' $MINIO_ACCESSKEY_SECRETKEY_TMP +{{ else }} +echo {{ .secretKey }} >> $MINIO_ACCESSKEY_SECRETKEY_TMP +{{- end }} +{{- if $svc.policy}} +createSvcacct {{ .user }} svc_policy_{{ $idx }} +{{ else }} +createSvcacct {{ .user }} +{{- end }} +{{- end }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/_helper_create_user.txt b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/_helper_create_user.txt new file mode 100644 index 000000000..9f2c6a4d8 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/_helper_create_user.txt @@ -0,0 +1,107 @@ +#!/bin/sh +set -e ; # Have script exit in the event of a failed command. + +{{- if .Values.configPathmc }} +MC_CONFIG_DIR="{{ .Values.configPathmc }}" +MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}" +{{- else }} +MC="/usr/bin/mc --insecure" +{{- end }} + +# AccessKey and secretkey credentials file are added to prevent shell execution errors caused by special characters. +# Special characters for example : ',",<,>,{,} +MINIO_ACCESSKEY_SECRETKEY_TMP="/tmp/accessKey_and_secretKey_tmp" + +# connectToMinio +# Use a check-sleep-check loop to wait for MinIO service to be available +connectToMinio() { + SCHEME=$1 + ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts + set -e ; # fail if we can't read the keys. + ACCESS=$(cat /config/rootUser) ; SECRET=$(cat /config/rootPassword) ; + set +e ; # The connections to minio are allowed to fail. + echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ; + MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ; + $MC_COMMAND ; + STATUS=$? ; + until [ $STATUS = 0 ] + do + ATTEMPTS=`expr $ATTEMPTS + 1` ; + echo \"Failed attempts: $ATTEMPTS\" ; + if [ $ATTEMPTS -gt $LIMIT ]; then + exit 1 ; + fi ; + sleep 2 ; # 1 second intervals between attempts + $MC_COMMAND ; + STATUS=$? ; + done ; + set -e ; # reset `e` as active + return 0 +} + +# checkUserExists () +# Check if the user exists, by using the exit code of `mc admin user info` +checkUserExists() { + CMD=$(${MC} admin user info myminio $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) > /dev/null 2>&1) + return $? +} + +# createUser ($policy) +createUser() { + POLICY=$1 + #check accessKey_and_secretKey_tmp file + if [[ ! -f $MINIO_ACCESSKEY_SECRETKEY_TMP ]];then + echo "credentials file does not exist" + return 1 + fi + if [[ $(cat $MINIO_ACCESSKEY_SECRETKEY_TMP|wc -l) -ne 2 ]];then + echo "credentials file is invalid" + rm -f $MINIO_ACCESSKEY_SECRETKEY_TMP + return 1 + fi + USER=$(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) + # Create the user if it does not exist + if ! checkUserExists ; then + echo "Creating user '$USER'" + cat $MINIO_ACCESSKEY_SECRETKEY_TMP | ${MC} admin user add myminio + else + echo "User '$USER' already exists." + fi + #clean up credentials files. + rm -f $MINIO_ACCESSKEY_SECRETKEY_TMP + + # set policy for user + if [ ! -z $POLICY -a $POLICY != " " ] ; then + echo "Adding policy '$POLICY' for '$USER'" + set +e ; # policy already attach errors out, allow it. + ${MC} admin policy attach myminio $POLICY --user=$USER + set -e + else + echo "User '$USER' has no policy attached." + fi +} + +# Try connecting to MinIO instance +{{- if .Values.tls.enabled }} +scheme=https +{{- else }} +scheme=http +{{- end }} +connectToMinio $scheme + +{{ if .Values.users }} +{{ $global := . }} +# Create the users +{{- range .Values.users }} +echo {{ tpl .accessKey $global }} > $MINIO_ACCESSKEY_SECRETKEY_TMP +{{- if .existingSecret }} +cat /config/secrets/{{ tpl .existingSecret $global }}/{{ tpl .existingSecretKey $global }} >> $MINIO_ACCESSKEY_SECRETKEY_TMP +# Add a new line if it doesn't exist +sed -i '$a\' $MINIO_ACCESSKEY_SECRETKEY_TMP +createUser {{ .policy }} +{{ else }} +echo {{ .secretKey }} >> $MINIO_ACCESSKEY_SECRETKEY_TMP +createUser {{ .policy }} +{{- end }} +{{- end }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/_helper_custom_command.txt b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/_helper_custom_command.txt new file mode 100644 index 000000000..b583a7782 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/_helper_custom_command.txt @@ -0,0 +1,58 @@ +#!/bin/sh +set -e ; # Have script exit in the event of a failed command. + +{{- if .Values.configPathmc }} +MC_CONFIG_DIR="{{ .Values.configPathmc }}" +MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}" +{{- else }} +MC="/usr/bin/mc --insecure" +{{- end }} + +# connectToMinio +# Use a check-sleep-check loop to wait for MinIO service to be available +connectToMinio() { + SCHEME=$1 + ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts + set -e ; # fail if we can't read the keys. + ACCESS=$(cat /config/rootUser) ; SECRET=$(cat /config/rootPassword) ; + set +e ; # The connections to minio are allowed to fail. + echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ; + MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ; + $MC_COMMAND ; + STATUS=$? ; + until [ $STATUS = 0 ] + do + ATTEMPTS=`expr $ATTEMPTS + 1` ; + echo \"Failed attempts: $ATTEMPTS\" ; + if [ $ATTEMPTS -gt $LIMIT ]; then + exit 1 ; + fi ; + sleep 2 ; # 1 second intervals between attempts + $MC_COMMAND ; + STATUS=$? ; + done ; + set -e ; # reset `e` as active + return 0 +} + +# runCommand ($@) +# Run custom mc command +runCommand() { + ${MC} "$@" + return $? +} + +# Try connecting to MinIO instance +{{- if .Values.tls.enabled }} +scheme=https +{{- else }} +scheme=http +{{- end }} +connectToMinio $scheme + +{{ if .Values.customCommands }} +# Run custom commands +{{- range .Values.customCommands }} +runCommand {{ .command }} +{{- end }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/_helper_policy.tpl b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/_helper_policy.tpl new file mode 100644 index 000000000..f2150530b --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/_helper_policy.tpl @@ -0,0 +1,28 @@ +{{- $statements_length := len .statements -}} +{{- $statements_length := sub $statements_length 1 -}} +{ + "Version": "2012-10-17", + "Statement": [ +{{- range $i, $statement := .statements }} + { + "Effect": "Allow", + "Action": [ +"{{ $statement.actions | join "\",\n\"" }}" + ]{{ if $statement.resources }}, + "Resource": [ +"{{ $statement.resources | join "\",\n\"" }}" + ]{{ end }} +{{- if $statement.conditions }} +{{- $condition_len := len $statement.conditions }} +{{- $condition_len := sub $condition_len 1 }} + , + "Condition": { + {{- range $k,$v := $statement.conditions }} + {{- range $operator,$object := $v }} + "{{ $operator }}": { {{ $object }} }{{- if lt $k $condition_len }},{{- end }} + {{- end }}{{- end }} + }{{- end }} + }{{ if lt $i $statements_length }},{{end }} +{{- end }} + ] +} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/_helpers.tpl b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/_helpers.tpl new file mode 100644 index 000000000..3141a8a9b --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/_helpers.tpl @@ -0,0 +1,246 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "minio.name" -}} + {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "minio.fullname" -}} + {{- if .Values.fullnameOverride -}} + {{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} + {{- else -}} + {{- $name := default .Chart.Name .Values.nameOverride -}} + {{- if contains $name .Release.Name -}} + {{- .Release.Name | trunc 63 | trimSuffix "-" -}} + {{- else -}} + {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} + {{- end -}} + {{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "minio.chart" -}} + {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for networkpolicy. +*/}} +{{- define "minio.networkPolicy.apiVersion" -}} + {{- if semverCompare ">=1.4-0, <1.7-0" .Capabilities.KubeVersion.Version -}} + {{- print "extensions/v1beta1" -}} + {{- else if semverCompare ">=1.7-0, <1.16-0" .Capabilities.KubeVersion.Version -}} + {{- print "networking.k8s.io/v1beta1" -}} + {{- else if semverCompare "^1.16-0" .Capabilities.KubeVersion.Version -}} + {{- print "networking.k8s.io/v1" -}} + {{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for deployment. +*/}} +{{- define "minio.deployment.apiVersion" -}} + {{- if semverCompare "<1.9-0" .Capabilities.KubeVersion.Version -}} + {{- print "apps/v1beta2" -}} + {{- else -}} + {{- print "apps/v1" -}} + {{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for statefulset. +*/}} +{{- define "minio.statefulset.apiVersion" -}} + {{- if semverCompare "<1.16-0" .Capabilities.KubeVersion.Version -}} + {{- print "apps/v1beta2" -}} + {{- else -}} + {{- print "apps/v1" -}} + {{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for ingress. +*/}} +{{- define "minio.ingress.apiVersion" -}} + {{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}} + {{- print "extensions/v1beta1" -}} + {{- else if semverCompare "<1.19-0" .Capabilities.KubeVersion.GitVersion -}} + {{- print "networking.k8s.io/v1beta1" -}} + {{- else -}} + {{- print "networking.k8s.io/v1" -}} + {{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for console ingress. +*/}} +{{- define "minio.consoleIngress.apiVersion" -}} + {{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}} + {{- print "extensions/v1beta1" -}} + {{- else if semverCompare "<1.19-0" .Capabilities.KubeVersion.GitVersion -}} + {{- print "networking.k8s.io/v1beta1" -}} + {{- else -}} + {{- print "networking.k8s.io/v1" -}} + {{- end -}} +{{- end -}} + +{{/* +Determine secret name. +*/}} +{{- define "minio.secretName" -}} + {{- if .Values.existingSecret -}} + {{- .Values.existingSecret }} + {{- else -}} + {{- include "minio.fullname" . -}} + {{- end -}} +{{- end -}} + +{{/* +Determine name for scc role and rolebinding +*/}} +{{- define "minio.sccRoleName" -}} + {{- printf "%s-%s" "scc" (include "minio.fullname" .) | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Properly format optional additional arguments to MinIO binary +*/}} +{{- define "minio.extraArgs" -}} +{{- range .Values.extraArgs -}} +{{ " " }}{{ . }} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names +*/}} +{{- define "minio.imagePullSecrets" -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else logic. +Also, we can not use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} +{{- if .Values.global.imagePullSecrets }} +imagePullSecrets: +{{- range .Values.global.imagePullSecrets }} + - name: {{ . }} +{{- end }} +{{- else if .Values.imagePullSecrets }} +imagePullSecrets: + {{ toYaml .Values.imagePullSecrets }} +{{- end -}} +{{- else if .Values.imagePullSecrets }} +imagePullSecrets: + {{ toYaml .Values.imagePullSecrets }} +{{- end -}} +{{- end -}} + +{{/* +Formats volumeMount for MinIO TLS keys and trusted certs +*/}} +{{- define "minio.tlsKeysVolumeMount" -}} +{{- if .Values.tls.enabled }} +- name: cert-secret-volume + mountPath: {{ .Values.certsPath }} +{{- end }} +{{- if or .Values.tls.enabled (ne .Values.trustedCertsSecret "") }} +{{- $casPath := printf "%s/CAs" .Values.certsPath | clean }} +- name: trusted-cert-secret-volume + mountPath: {{ $casPath }} +{{- end }} +{{- end -}} + +{{/* +Formats volume for MinIO TLS keys and trusted certs +*/}} +{{- define "minio.tlsKeysVolume" -}} +{{- if .Values.tls.enabled }} +- name: cert-secret-volume + secret: + secretName: {{ tpl .Values.tls.certSecret $ }} + items: + - key: {{ .Values.tls.publicCrt }} + path: public.crt + - key: {{ .Values.tls.privateKey }} + path: private.key +{{- end }} +{{- if or .Values.tls.enabled (ne .Values.trustedCertsSecret "") }} +{{- $certSecret := eq .Values.trustedCertsSecret "" | ternary .Values.tls.certSecret .Values.trustedCertsSecret }} +{{- $publicCrt := eq .Values.trustedCertsSecret "" | ternary .Values.tls.publicCrt "" }} +- name: trusted-cert-secret-volume + secret: + secretName: {{ $certSecret }} + {{- if ne $publicCrt "" }} + items: + - key: {{ $publicCrt }} + path: public.crt + {{- end }} +{{- end }} +{{- end -}} + +{{/* +Returns the available value for certain key in an existing secret (if it exists), +otherwise it generates a random value. +*/}} +{{- define "minio.getValueFromSecret" }} + {{- $len := (default 16 .Length) | int -}} + {{- $obj := (lookup "v1" "Secret" .Namespace .Name).data -}} + {{- if $obj }} + {{- index $obj .Key | b64dec -}} + {{- else -}} + {{- randAlphaNum $len -}} + {{- end -}} +{{- end }} + +{{- define "minio.root.username" -}} + {{- if .Values.rootUser }} + {{- .Values.rootUser | toString }} + {{- else }} + {{- include "minio.getValueFromSecret" (dict "Namespace" .Release.Namespace "Name" (include "minio.fullname" .) "Length" 20 "Key" "rootUser") }} + {{- end }} +{{- end -}} + +{{- define "minio.root.password" -}} + {{- if .Values.rootPassword }} + {{- .Values.rootPassword | toString }} + {{- else }} + {{- include "minio.getValueFromSecret" (dict "Namespace" .Release.Namespace "Name" (include "minio.fullname" .) "Length" 40 "Key" "rootPassword") }} + {{- end }} +{{- end -}} + +{{/* +Windows cluster will add default taint for linux nodes, add below linux tolerations to +workloads could be scheduled to those linux nodes +*/}} +{{- define "linux-node-tolerations" -}} +- key: "cattle.io/os" + value: "linux" + effect: "NoSchedule" + operator: "Equal" +{{- end -}} + +{{- define "linux-node-selector" -}} +{{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}} +beta.kubernetes.io/os: linux +{{- else -}} +kubernetes.io/os: linux +{{- end -}} +{{- end -}} + +{{/* +URL prefix for container images to be compatible with Rancher +*/}} +{{- define "registry-url" -}} +{{- if .Values.global.cattle.systemDefaultRegistry -}} +{{ trimSuffix "/" .Values.global.cattle.systemDefaultRegistry }}/ +{{- end -}} +{{- end -}} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/configmap.yaml b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/configmap.yaml new file mode 100644 index 000000000..47f64cc23 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/configmap.yaml @@ -0,0 +1,32 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "minio.fullname" . }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +data: + initialize: |- + {{- include (print $.Template.BasePath "/_helper_create_bucket.txt") . | nindent 4 }} + add-user: |- + {{- include (print $.Template.BasePath "/_helper_create_user.txt") . | nindent 4 }} + add-policy: |- + {{- include (print $.Template.BasePath "/_helper_create_policy.txt") . | nindent 4 }} + {{- range $idx, $policy := .Values.policies }} + # Policy: {{ $policy.name }} + policy_{{ $idx }}.json: |- + {{- include (print $.Template.BasePath "/_helper_policy.tpl") . | nindent 4 }} + {{ end }} + {{- range $idx, $svc := .Values.svcaccts }} + {{- if $svc.policy }} + # SVC: {{ $svc.accessKey }} + svc_policy_{{ $idx }}.json: |- + {{- include (print $.Template.BasePath "/_helper_policy.tpl") .policy | nindent 4 }} + {{- end }} + {{- end }} + add-svcacct: |- + {{- include (print $.Template.BasePath "/_helper_create_svcacct.txt") . | nindent 4 }} + custom-command: |- + {{- include (print $.Template.BasePath "/_helper_custom_command.txt") . | nindent 4 }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/console-ingress.yaml b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/console-ingress.yaml new file mode 100644 index 000000000..79a2b1b58 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/console-ingress.yaml @@ -0,0 +1,55 @@ +{{- if .Values.consoleIngress.enabled -}} +{{- $fullName := printf "%s-console" (include "minio.fullname" .) -}} +{{- $servicePort := .Values.consoleService.port -}} +{{- $ingressPath := .Values.consoleIngress.path -}} +apiVersion: {{ template "minio.consoleIngress.apiVersion" . }} +kind: Ingress +metadata: + name: {{ $fullName }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- with .Values.consoleIngress.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.consoleIngress.annotations }} + annotations: {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if .Values.consoleIngress.ingressClassName }} + ingressClassName: {{ .Values.consoleIngress.ingressClassName }} + {{- end }} + {{- if .Values.consoleIngress.tls }} + tls: + {{- range .Values.consoleIngress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} + {{- end }} + rules: + {{- range .Values.consoleIngress.hosts }} + - http: + paths: + - path: {{ $ingressPath }} + {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }} + pathType: Prefix + backend: + service: + name: {{ $fullName }} + port: + number: {{ $servicePort }} + {{- else }} + backend: + serviceName: {{ $fullName }} + servicePort: {{ $servicePort }} + {{- end }} + {{- if . }} + host: {{ tpl . $ | quote }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/console-service.yaml b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/console-service.yaml new file mode 100644 index 000000000..2bbe7e385 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/console-service.yaml @@ -0,0 +1,43 @@ +{{ $scheme := .Values.tls.enabled | ternary "https" "http" }} +apiVersion: v1 +kind: Service +metadata: + name: {{ template "minio.fullname" . }}-console + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- if .Values.consoleService.annotations }} + annotations: {{- toYaml .Values.consoleService.annotations | nindent 4 }} + {{- end }} +spec: + {{- if (or (eq .Values.consoleService.type "ClusterIP" "") (empty .Values.consoleService.type)) }} + type: ClusterIP + {{- if not (empty .Values.consoleService.clusterIP) }} + clusterIP: {{ .Values.consoleService.clusterIP }} + {{- end }} + {{- else if eq .Values.consoleService.type "LoadBalancer" }} + type: {{ .Values.consoleService.type }} + loadBalancerIP: {{ default "" .Values.consoleService.loadBalancerIP }} + {{- else }} + type: {{ .Values.consoleService.type }} + {{- end }} + ports: + - name: {{ $scheme }} + port: {{ .Values.consoleService.port }} + protocol: TCP + {{- if (and (eq .Values.consoleService.type "NodePort") ( .Values.consoleService.nodePort)) }} + nodePort: {{ .Values.consoleService.nodePort }} + {{- else }} + targetPort: {{ .Values.minioConsolePort }} + {{- end }} + {{- if .Values.consoleService.externalIPs }} + externalIPs: + {{- range $i , $ip := .Values.consoleService.externalIPs }} + - {{ $ip }} + {{- end }} + {{- end }} + selector: + app: {{ template "minio.name" . }} + release: {{ .Release.Name }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/deployment.yaml b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/deployment.yaml new file mode 100644 index 000000000..bbc762b6b --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/deployment.yaml @@ -0,0 +1,198 @@ +{{- if eq .Values.mode "standalone" }} +{{ $scheme := .Values.tls.enabled | ternary "https" "http" }} +{{ $bucketRoot := or ($.Values.bucketRoot) ($.Values.mountPath) }} +apiVersion: {{ template "minio.deployment.apiVersion" . }} +kind: Deployment +metadata: + name: {{ template "minio.fullname" . }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- if .Values.additionalLabels }} + {{- toYaml .Values.additionalLabels | nindent 4 }} + {{- end }} + {{- if .Values.additionalAnnotations }} + annotations: {{- toYaml .Values.additionalAnnotations | nindent 4 }} + {{- end }} +spec: + strategy: + type: {{ .Values.deploymentUpdate.type }} + {{- if eq .Values.deploymentUpdate.type "RollingUpdate" }} + rollingUpdate: + maxSurge: {{ .Values.deploymentUpdate.maxSurge }} + maxUnavailable: {{ .Values.deploymentUpdate.maxUnavailable }} + {{- end }} + replicas: 1 + selector: + matchLabels: + app: {{ template "minio.name" . }} + release: {{ .Release.Name }} + template: + metadata: + name: {{ template "minio.fullname" . }} + labels: + app: {{ template "minio.name" . }} + release: {{ .Release.Name }} + {{- if .Values.podLabels }} + {{- toYaml .Values.podLabels | nindent 8 }} + {{- end }} + annotations: + {{- if not .Values.ignoreChartChecksums }} + checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }} + checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} + {{- end }} + {{- if .Values.podAnnotations }} + {{- toYaml .Values.podAnnotations | trimSuffix "\n" | nindent 8 }} + {{- end }} + spec: + {{- if .Values.priorityClassName }} + priorityClassName: "{{ .Values.priorityClassName }}" + {{- end }} + {{- if .Values.runtimeClassName }} + runtimeClassName: "{{ .Values.runtimeClassName }}" + {{- end }} + {{- if and .Values.securityContext.enabled .Values.persistence.enabled }} + securityContext: + runAsUser: {{ .Values.securityContext.runAsUser }} + runAsGroup: {{ .Values.securityContext.runAsGroup }} + fsGroup: {{ .Values.securityContext.fsGroup }} + {{- if and (ge .Capabilities.KubeVersion.Major "1") (ge .Capabilities.KubeVersion.Minor "20") }} + fsGroupChangePolicy: {{ .Values.securityContext.fsGroupChangePolicy }} + {{- end }} + {{- end }} + {{ if .Values.serviceAccount.create }} + serviceAccountName: {{ .Values.serviceAccount.name }} + {{- end }} + containers: + - name: {{ .Chart.Name }} + image: "{{ default .Values.image.registry (include "registry-url" .) }}{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + command: + - "/bin/sh" + - "-ce" + - "/usr/bin/docker-entrypoint.sh minio server {{ $bucketRoot }} -S {{ .Values.certsPath }} --address :{{ .Values.minioAPIPort }} --console-address :{{ .Values.minioConsolePort }} {{- template "minio.extraArgs" . }}" + volumeMounts: + - name: minio-user + mountPath: "/tmp/credentials" + readOnly: true + - name: export + mountPath: {{ .Values.mountPath }} + {{- if and .Values.persistence.enabled .Values.persistence.subPath }} + subPath: "{{ .Values.persistence.subPath }}" + {{- end }} + {{- if .Values.extraSecret }} + - name: extra-secret + mountPath: "/tmp/minio-config-env" + {{- end }} + {{- include "minio.tlsKeysVolumeMount" . | indent 12 }} + {{- if .Values.extraVolumeMounts }} + {{- toYaml .Values.extraVolumeMounts | nindent 12 }} + {{- end }} + ports: + - name: {{ $scheme }} + containerPort: {{ .Values.minioAPIPort }} + - name: {{ $scheme }}-console + containerPort: {{ .Values.minioConsolePort }} + env: + - name: MINIO_ROOT_USER + valueFrom: + secretKeyRef: + name: {{ template "minio.secretName" . }} + key: rootUser + - name: MINIO_ROOT_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "minio.secretName" . }} + key: rootPassword + {{- if .Values.extraSecret }} + - name: MINIO_CONFIG_ENV_FILE + value: "/tmp/minio-config-env/config.env" + {{- end }} + {{- if .Values.metrics.serviceMonitor.public }} + - name: MINIO_PROMETHEUS_AUTH_TYPE + value: "public" + {{- end }} + {{- if .Values.oidc.enabled }} + - name: MINIO_IDENTITY_OPENID_CONFIG_URL + value: {{ .Values.oidc.configUrl }} + - name: MINIO_IDENTITY_OPENID_CLIENT_ID + value: {{ .Values.oidc.clientId }} + - name: MINIO_IDENTITY_OPENID_CLIENT_SECRET + value: {{ .Values.oidc.clientSecret }} + - name: MINIO_IDENTITY_OPENID_CLAIM_NAME + value: {{ .Values.oidc.claimName }} + - name: MINIO_IDENTITY_OPENID_CLAIM_PREFIX + value: {{ .Values.oidc.claimPrefix }} + - name: MINIO_IDENTITY_OPENID_SCOPES + value: {{ .Values.oidc.scopes }} + - name: MINIO_IDENTITY_OPENID_REDIRECT_URI + value: {{ .Values.oidc.redirectUri }} + - name: MINIO_IDENTITY_OPENID_COMMENT + value: {{ .Values.oidc.comment }} + {{- end }} + {{- if .Values.etcd.endpoints }} + - name: MINIO_ETCD_ENDPOINTS + value: {{ join "," .Values.etcd.endpoints | quote }} + {{- if .Values.etcd.clientCert }} + - name: MINIO_ETCD_CLIENT_CERT + value: "/tmp/credentials/etcd_client_cert.pem" + {{- end }} + {{- if .Values.etcd.clientCertKey }} + - name: MINIO_ETCD_CLIENT_CERT_KEY + value: "/tmp/credentials/etcd_client_cert_key.pem" + {{- end }} + {{- if .Values.etcd.pathPrefix }} + - name: MINIO_ETCD_PATH_PREFIX + value: {{ .Values.etcd.pathPrefix }} + {{- end }} + {{- if .Values.etcd.corednsPathPrefix }} + - name: MINIO_ETCD_COREDNS_PATH + value: {{ .Values.etcd.corednsPathPrefix }} + {{- end }} + {{- end }} + {{- range $key, $val := .Values.environment }} + - name: {{ $key }} + value: {{ tpl $val $ | quote }} + {{- end }} + resources: {{- toYaml .Values.resources | nindent 12 }} + {{- with .Values.extraContainers }} + {{- if eq (typeOf .) "string" }} + {{- tpl . $ | nindent 8 }} + {{- else }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- end }} + nodeSelector: + {{- include "linux-node-selector" . | nindent 8 }} + {{- include "minio.imagePullSecrets" . | indent 6 }} + {{- with .Values.affinity }} + affinity: {{- toYaml . | nindent 8 }} + {{- end }} + tolerations: {{- toYaml . | nindent 8 }} + {{- include "linux-node-tolerations" . | nindent 8 }} + {{- with .Values.tolerations }} + {{ toYaml . | indent 8 }} + {{- end }} + volumes: + - name: export + {{- if .Values.persistence.enabled }} + persistentVolumeClaim: + claimName: {{ .Values.persistence.existingClaim | default (include "minio.fullname" .) }} + {{- else }} + emptyDir: {} + {{- end }} + {{- if .Values.extraSecret }} + - name: extra-secret + secret: + secretName: {{ .Values.extraSecret }} + {{- end }} + - name: minio-user + secret: + secretName: {{ template "minio.secretName" . }} + {{- include "minio.tlsKeysVolume" . | indent 8 }} + {{- if .Values.extraVolumes }} + {{ toYaml .Values.extraVolumes | nindent 8 }} + {{- end }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/ingress.yaml b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/ingress.yaml new file mode 100644 index 000000000..1a564c6bc --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/ingress.yaml @@ -0,0 +1,55 @@ +{{- if .Values.ingress.enabled -}} +{{- $fullName := include "minio.fullname" . -}} +{{- $servicePort := .Values.service.port -}} +{{- $ingressPath := .Values.ingress.path -}} +apiVersion: {{ template "minio.ingress.apiVersion" . }} +kind: Ingress +metadata: + name: {{ $fullName }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- with .Values.ingress.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.ingress.annotations }} + annotations: {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if .Values.ingress.ingressClassName }} + ingressClassName: {{ .Values.ingress.ingressClassName }} + {{- end }} + {{- if .Values.ingress.tls }} + tls: + {{- range .Values.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} + {{- end }} + rules: + {{- range .Values.ingress.hosts }} + - http: + paths: + - path: {{ $ingressPath }} + {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }} + pathType: Prefix + backend: + service: + name: {{ $fullName }} + port: + number: {{ $servicePort }} + {{- else }} + backend: + serviceName: {{ $fullName }} + servicePort: {{ $servicePort }} + {{- end }} + {{- if . }} + host: {{ tpl . $ | quote }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/networkpolicy.yaml b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/networkpolicy.yaml new file mode 100644 index 000000000..7ebc2aa73 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/networkpolicy.yaml @@ -0,0 +1,26 @@ +{{- if .Values.networkPolicy.enabled }} +kind: NetworkPolicy +apiVersion: {{ template "minio.networkPolicy.apiVersion" . }} +metadata: + name: {{ template "minio.fullname" . }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + podSelector: + matchLabels: + app: {{ template "minio.name" . }} + release: {{ .Release.Name }} + ingress: + - ports: + - port: {{ .Values.minioAPIPort }} + - port: {{ .Values.minioConsolePort }} + {{- if not .Values.networkPolicy.allowExternal }} + from: + - podSelector: + matchLabels: + {{ template "minio.name" . }}-client: "true" + {{- end }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/poddisruptionbudget.yaml b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/poddisruptionbudget.yaml new file mode 100644 index 000000000..a5f90a080 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/poddisruptionbudget.yaml @@ -0,0 +1,17 @@ +{{- if .Values.podDisruptionBudget.enabled }} +{{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodDisruptionBudget" }} +apiVersion: policy/v1beta1 +{{- else }} +apiVersion: policy/v1 +{{- end }} +kind: PodDisruptionBudget +metadata: + name: minio + labels: + app: {{ template "minio.name" . }} +spec: + maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }} + selector: + matchLabels: + app: {{ template "minio.name" . }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/post-job.yaml b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/post-job.yaml new file mode 100644 index 000000000..8bb37b7f3 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/post-job.yaml @@ -0,0 +1,256 @@ +{{- if or .Values.buckets .Values.users .Values.policies .Values.customCommands .Values.svcaccts }} +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ template "minio.fullname" . }}-post-job + labels: + app: {{ template "minio.name" . }}-post-job + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + annotations: + "helm.sh/hook": post-install,post-upgrade + "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation + {{- with .Values.postJob.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + template: + metadata: + labels: + app: {{ template "minio.name" . }}-job + release: {{ .Release.Name }} + {{- if .Values.podLabels }} + {{- toYaml .Values.podLabels | nindent 8 }} + {{- end }} + {{- if .Values.postJob.podAnnotations }} + annotations: {{- toYaml .Values.postJob.podAnnotations | nindent 8 }} + {{- end }} + spec: + restartPolicy: OnFailure + {{- include "minio.imagePullSecrets" . | indent 6 }} + nodeSelector: + {{- include "linux-node-selector" . | nindent 8 }} + {{- with .Values.postJob.affinity }} + affinity: {{- toYaml . | nindent 8 }} + {{- end }} + tolerations: + {{- include "linux-node-tolerations" . | nindent 8 }} + {{- with .Values.postJob.tolerations }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if .Values.postJob.securityContext.enabled }} + securityContext: + runAsUser: {{ .Values.postJob.securityContext.runAsUser }} + runAsGroup: {{ .Values.postJob.securityContext.runAsGroup }} + fsGroup: {{ .Values.postJob.securityContext.fsGroup }} + {{- end }} + volumes: + - name: etc-path + emptyDir: {} + - name: tmp + emptyDir: {} + - name: minio-configuration + projected: + sources: + - configMap: + name: {{ template "minio.fullname" . }} + - secret: + name: {{ template "minio.secretName" . }} + {{- range (concat .Values.users (default (list) .Values.svcaccts)) }} + {{- if .existingSecret }} + - secret: + name: {{ tpl .existingSecret $ }} + items: + - key: {{ .existingSecretKey }} + path: secrets/{{ tpl .existingSecret $ }}/{{ tpl .existingSecretKey $ }} + {{- end }} + {{- end }} + {{- range ( default list .Values.svcaccts ) }} + {{- if .existingSecret }} + - secret: + name: {{ tpl .existingSecret $ }} + items: + - key: {{ .existingSecretKey }} + path: secrets-svc/{{ tpl .existingSecret $ }}/{{ tpl .existingSecretKey $ }} + {{- end }} + {{- end }} + {{- if .Values.tls.enabled }} + - name: cert-secret-volume-mc + secret: + secretName: {{ .Values.tls.certSecret }} + items: + - key: {{ .Values.tls.publicCrt }} + path: CAs/public.crt + {{- end }} + {{- if .Values.serviceAccount.create }} + serviceAccountName: {{ .Values.serviceAccount.name }} + {{- end }} + {{- if .Values.policies }} + initContainers: + - name: minio-make-policy + image: "{{ default .Values.mcImage.registry (include "registry-url" .) }}{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" + {{- if .Values.makePolicyJob.securityContext.enabled }} + securityContext: + runAsUser: {{ .Values.makePolicyJob.securityContext.runAsUser }} + runAsGroup: {{ .Values.makePolicyJob.securityContext.runAsGroup }} + {{- end }} + imagePullPolicy: {{ .Values.mcImage.pullPolicy }} + {{- if .Values.makePolicyJob.exitCommand }} + command: [ "/bin/sh", "-c" ] + args: [ "/bin/sh /config/add-policy; EV=$?; {{ .Values.makePolicyJob.exitCommand }} && exit $EV" ] + {{- else }} + command: [ "/bin/sh", "/config/add-policy" ] + {{- end }} + env: + - name: MINIO_ENDPOINT + value: {{ template "minio.fullname" . }} + - name: MINIO_PORT + value: {{ .Values.service.port | quote }} + volumeMounts: + - name: etc-path + mountPath: /etc/minio/mc + - name: tmp + mountPath: /tmp + - name: minio-configuration + mountPath: /config + {{- if .Values.tls.enabled }} + - name: cert-secret-volume-mc + mountPath: {{ .Values.configPathmc }}certs + {{- end }} + resources: {{- toYaml .Values.makePolicyJob.resources | nindent 12 }} + {{- end }} + containers: + {{- if .Values.buckets }} + - name: minio-make-bucket + image: "{{ default .Values.mcImage.registry (include "registry-url" .) }}{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" + {{- if .Values.makeBucketJob.securityContext.enabled }} + securityContext: + runAsUser: {{ .Values.makeBucketJob.securityContext.runAsUser }} + runAsGroup: {{ .Values.makeBucketJob.securityContext.runAsGroup }} + {{- end }} + imagePullPolicy: {{ .Values.mcImage.pullPolicy }} + {{- if .Values.makeBucketJob.exitCommand }} + command: [ "/bin/sh", "-c" ] + args: [ "/bin/sh /config/initialize; EV=$?; {{ .Values.makeBucketJob.exitCommand }} && exit $EV" ] + {{- else }} + command: [ "/bin/sh", "/config/initialize" ] + {{- end }} + env: + - name: MINIO_ENDPOINT + value: {{ template "minio.fullname" . }} + - name: MINIO_PORT + value: {{ .Values.service.port | quote }} + volumeMounts: + - name: etc-path + mountPath: /etc/minio/mc + - name: tmp + mountPath: /tmp + - name: minio-configuration + mountPath: /config + {{- if .Values.tls.enabled }} + - name: cert-secret-volume-mc + mountPath: {{ .Values.configPathmc }}certs + {{- end }} + resources: {{- toYaml .Values.makeBucketJob.resources | nindent 12 }} + {{- end }} + {{- if .Values.users }} + - name: minio-make-user + image: "{{ default .Values.mcImage.registry (include "registry-url" .) }}{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" + {{- if .Values.makeUserJob.securityContext.enabled }} + securityContext: + runAsUser: {{ .Values.makeUserJob.securityContext.runAsUser }} + runAsGroup: {{ .Values.makeUserJob.securityContext.runAsGroup }} + {{- end }} + imagePullPolicy: {{ .Values.mcImage.pullPolicy }} + {{- if .Values.makeUserJob.exitCommand }} + command: [ "/bin/sh", "-c" ] + args: [ "/bin/sh /config/add-user; EV=$?; {{ .Values.makeUserJob.exitCommand }} && exit $EV" ] + {{- else }} + command: [ "/bin/sh", "/config/add-user" ] + {{- end }} + env: + - name: MINIO_ENDPOINT + value: {{ template "minio.fullname" . }} + - name: MINIO_PORT + value: {{ .Values.service.port | quote }} + volumeMounts: + - name: etc-path + mountPath: /etc/minio/mc + - name: tmp + mountPath: /tmp + - name: minio-configuration + mountPath: /config + {{- if .Values.tls.enabled }} + - name: cert-secret-volume-mc + mountPath: {{ .Values.configPathmc }}certs + {{- end }} + resources: {{- toYaml .Values.makeUserJob.resources | nindent 12 }} + {{- end }} + {{- if .Values.customCommands }} + - name: minio-custom-command + image: "{{ default .Values.mcImage.registry (include "registry-url" .) }}{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" + {{- if .Values.customCommandJob.securityContext.enabled }} + securityContext: + runAsUser: {{ .Values.customCommandJob.securityContext.runAsUser }} + runAsGroup: {{ .Values.customCommandJob.securityContext.runAsGroup }} + {{- end }} + imagePullPolicy: {{ .Values.mcImage.pullPolicy }} + {{- if .Values.customCommandJob.exitCommand }} + command: [ "/bin/sh", "-c" ] + args: [ "/bin/sh /config/custom-command; EV=$?; {{ .Values.customCommandJob.exitCommand }} && exit $EV" ] + {{- else }} + command: [ "/bin/sh", "/config/custom-command" ] + {{- end }} + env: + - name: MINIO_ENDPOINT + value: {{ template "minio.fullname" . }} + - name: MINIO_PORT + value: {{ .Values.service.port | quote }} + volumeMounts: + - name: etc-path + mountPath: /etc/minio/mc + - name: tmp + mountPath: /tmp + - name: minio-configuration + mountPath: /config + {{- if .Values.tls.enabled }} + - name: cert-secret-volume-mc + mountPath: {{ .Values.configPathmc }}certs + {{- end }} + resources: {{- toYaml .Values.customCommandJob.resources | nindent 12 }} + {{- end }} + {{- if .Values.svcaccts }} + - name: minio-make-svcacct + image: "{{ default .Values.mcImage.registry (include "registry-url" .) }}{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" + {{- if .Values.makeServiceAccountJob.securityContext.enabled }} + securityContext: + runAsUser: {{ .Values.makeServiceAccountJob.securityContext.runAsUser }} + runAsGroup: {{ .Values.makeServiceAccountJob.securityContext.runAsGroup }} + {{- end }} + imagePullPolicy: {{ .Values.mcImage.pullPolicy }} + {{- if .Values.makeServiceAccountJob.exitCommand }} + command: [ "/bin/sh", "-c" ] + args: ["/bin/sh /config/add-svcacct; EV=$?; {{ .Values.makeServiceAccountJob.exitCommand }} && exit $EV" ] + {{- else }} + command: ["/bin/sh", "/config/add-svcacct"] + {{- end }} + env: + - name: MINIO_ENDPOINT + value: {{ template "minio.fullname" . }} + - name: MINIO_PORT + value: {{ .Values.service.port | quote }} + volumeMounts: + - name: etc-path + mountPath: /etc/minio/mc + - name: tmp + mountPath: /tmp + - name: minio-configuration + mountPath: /config + {{- if .Values.tls.enabled }} + - name: cert-secret-volume-mc + mountPath: {{ .Values.configPathmc }}certs + {{- end }} + resources: {{- toYaml .Values.makeServiceAccountJob.resources | nindent 12 }} + {{- end }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/psp.yaml b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/psp.yaml new file mode 100644 index 000000000..7b30c45e0 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/psp.yaml @@ -0,0 +1,86 @@ +{{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy" -}} +{{- if .Values.serviceAccount.create }} +{{- if .Values.global.rbac.pspEnabled }} + +--- +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: {{ printf "%s-psp" .Values.serviceAccount.name | quote }} + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: "{{ replace "+" "_" .Chart.Version }}" + app.kubernetes.io/part-of: {{ .Values.serviceAccount.name | quote }} + app: {{ .Values.serviceAccount.name | quote }} +{{- if .Values.global.rbac.pspAnnotations }} + annotations: {{ toYaml .Values.global.rbac.pspAnnotations | nindent 4 }} +{{- end }} +spec: + privileged: false + hostNetwork: false + hostIPC: false + hostPID: false + runAsUser: + # Permits the container to run with root privileges as well. + rule: 'RunAsAny' + seLinux: + # This policy assumes the nodes are using AppArmor rather than SELinux. + rule: 'RunAsAny' + supplementalGroups: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 0 + max: 65535 + fsGroup: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 0 + max: 65535 + readOnlyRootFilesystem: false + +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ printf "%s-psp" .Values.serviceAccount.name | quote }} + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: "{{ replace "+" "_" .Chart.Version }}" + app.kubernetes.io/part-of: {{ .Values.serviceAccount.name | quote }} + app: {{ .Values.serviceAccount.name | quote }} +rules: +{{- if semverCompare "> 1.15.0-0" .Capabilities.KubeVersion.GitVersion }} +- apiGroups: ['policy'] +{{- else }} +- apiGroups: ['extensions'] +{{- end }} + resources: ['podsecuritypolicies'] + verbs: ['use'] + resourceNames: + - {{ printf "%s-psp" .Values.serviceAccount.name | quote }} + +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ printf "%s-psp" .Values.serviceAccount.name | quote }} + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: "{{ replace "+" "_" .Chart.Version }}" + app.kubernetes.io/part-of: {{ .Values.serviceAccount.name | quote }} + app: {{ .Values.serviceAccount.name | quote }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ printf "%s-psp" .Values.serviceAccount.name | quote }} +subjects: + - kind: ServiceAccount + name: {{ .Values.serviceAccount.name | quote }} + namespace: {{ .Release.Namespace }} + +{{- end }} +{{- end }} +{{- end -}} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/pvc.yaml b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/pvc.yaml new file mode 100644 index 000000000..60f5267b0 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/pvc.yaml @@ -0,0 +1,32 @@ +{{- if eq .Values.mode "standalone" }} +{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }} +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: {{ template "minio.fullname" . }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- if .Values.persistence.annotations }} + annotations: {{- toYaml .Values.persistence.annotations | nindent 4 }} + {{- end }} +spec: + accessModes: + - {{ .Values.persistence.accessMode | quote }} + resources: + requests: + storage: {{ .Values.persistence.size | quote }} + {{- if .Values.persistence.storageClass }} + {{- if (eq "-" .Values.persistence.storageClass) }} + storageClassName: "" + {{- else }} + storageClassName: "{{ .Values.persistence.storageClass }}" + {{- end }} + {{- end }} + {{- if .Values.persistence.volumeName }} + volumeName: "{{ .Values.persistence.volumeName }}" + {{- end }} +{{- end }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/secrets.yaml b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/secrets.yaml new file mode 100644 index 000000000..476c3da51 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/secrets.yaml @@ -0,0 +1,21 @@ +{{- if not .Values.existingSecret }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "minio.secretName" . }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +type: Opaque +data: + rootUser: {{ include "minio.root.username" . | b64enc | quote }} + rootPassword: {{ include "minio.root.password" . | b64enc | quote }} + {{- if .Values.etcd.clientCert }} + etcd_client.crt: {{ .Values.etcd.clientCert | toString | b64enc | quote }} + {{- end }} + {{- if .Values.etcd.clientCertKey }} + etcd_client.key: {{ .Values.etcd.clientCertKey | toString | b64enc | quote }} + {{- end }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/securitycontextconstraints.yaml b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/securitycontextconstraints.yaml new file mode 100644 index 000000000..4bac7e372 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/securitycontextconstraints.yaml @@ -0,0 +1,45 @@ +{{- if and .Values.securityContext.enabled .Values.persistence.enabled (.Capabilities.APIVersions.Has "security.openshift.io/v1") }} +apiVersion: security.openshift.io/v1 +kind: SecurityContextConstraints +metadata: + name: {{ template "minio.fullname" . }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +allowHostDirVolumePlugin: false +allowHostIPC: false +allowHostNetwork: false +allowHostPID: false +allowHostPorts: false +allowPrivilegeEscalation: true +allowPrivilegedContainer: false +allowedCapabilities: [] +readOnlyRootFilesystem: false +defaultAddCapabilities: [] +requiredDropCapabilities: +- KILL +- MKNOD +- SETUID +- SETGID +fsGroup: + type: MustRunAs + ranges: + - max: {{ .Values.securityContext.fsGroup }} + min: {{ .Values.securityContext.fsGroup }} +runAsUser: + type: MustRunAs + uid: {{ .Values.securityContext.runAsUser }} +seLinuxContext: + type: MustRunAs +supplementalGroups: + type: RunAsAny +volumes: +- configMap +- downwardAPI +- emptyDir +- persistentVolumeClaim +- projected +- secret +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/service.yaml b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/service.yaml new file mode 100644 index 000000000..ba1f3feaa --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/service.yaml @@ -0,0 +1,44 @@ +{{ $scheme := .Values.tls.enabled | ternary "https" "http" }} +apiVersion: v1 +kind: Service +metadata: + name: {{ template "minio.fullname" . }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + monitoring: "true" + {{- if .Values.service.annotations }} + annotations: {{- toYaml .Values.service.annotations | nindent 4 }} + {{- end }} +spec: + {{- if (or (eq .Values.service.type "ClusterIP" "") (empty .Values.service.type)) }} + type: ClusterIP + {{- if not (empty .Values.service.clusterIP) }} + clusterIP: {{ .Values.service.clusterIP }} + {{- end }} + {{- else if eq .Values.service.type "LoadBalancer" }} + type: {{ .Values.service.type }} + loadBalancerIP: {{ default "" .Values.service.loadBalancerIP }} + {{- else }} + type: {{ .Values.service.type }} + {{- end }} + ports: + - name: {{ $scheme }} + port: {{ .Values.service.port }} + protocol: TCP + {{- if (and (eq .Values.service.type "NodePort") ( .Values.service.nodePort)) }} + nodePort: {{ .Values.service.nodePort }} + {{- else }} + targetPort: {{ .Values.minioAPIPort }} + {{- end }} + {{- if .Values.service.externalIPs }} + externalIPs: + {{- range $i , $ip := .Values.service.externalIPs }} + - {{ $ip }} + {{- end }} + {{- end }} + selector: + app: {{ template "minio.name" . }} + release: {{ .Release.Name }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/serviceaccount.yaml b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/serviceaccount.yaml new file mode 100644 index 000000000..07840153d --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/serviceaccount.yaml @@ -0,0 +1,6 @@ +{{- if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ .Values.serviceAccount.name | quote }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/servicemonitor.yaml b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/servicemonitor.yaml new file mode 100644 index 000000000..f875a850e --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/servicemonitor.yaml @@ -0,0 +1,112 @@ +{{- if and .Values.metrics.serviceMonitor.enabled .Values.metrics.serviceMonitor.includeNode }} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ template "minio.fullname" . }} + {{- if .Values.metrics.serviceMonitor.namespace }} + namespace: {{ .Values.metrics.serviceMonitor.namespace }} + {{- end }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- if .Values.metrics.serviceMonitor.additionalLabels }} + {{- toYaml .Values.metrics.serviceMonitor.additionalLabels | nindent 4 }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.annotations }} + annotations: {{- toYaml .Values.metrics.serviceMonitor.annotations | nindent 4 }} + {{- end }} +spec: + endpoints: + {{- if .Values.tls.enabled }} + - port: https + scheme: https + tlsConfig: + ca: + secret: + name: {{ .Values.tls.certSecret }} + key: {{ .Values.tls.publicCrt }} + serverName: {{ template "minio.fullname" . }} + {{- else }} + - port: http + scheme: http + {{- end }} + path: /minio/v2/metrics/node + {{- if .Values.metrics.serviceMonitor.interval }} + interval: {{ .Values.metrics.serviceMonitor.interval }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} + scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.relabelConfigs }} + {{- toYaml .Values.metrics.serviceMonitor.relabelConfigs | nindent 6 }} + {{- end }} + {{- if not .Values.metrics.serviceMonitor.public }} + bearerTokenSecret: + name: {{ template "minio.fullname" . }}-prometheus + key: token + {{- end }} + namespaceSelector: + matchNames: + - {{ .Release.Namespace | quote }} + selector: + matchLabels: + app: {{ include "minio.name" . }} + release: {{ .Release.Name }} + monitoring: "true" +{{- end }} +{{- if .Values.metrics.serviceMonitor.enabled }} +--- +apiVersion: monitoring.coreos.com/v1 +kind: Probe +metadata: + name: {{ template "minio.fullname" . }}-cluster + {{- if .Values.metrics.serviceMonitor.namespace }} + namespace: {{ .Values.metrics.serviceMonitor.namespace }} + {{- end }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- if .Values.metrics.serviceMonitor.additionalLabels }} + {{- toYaml .Values.metrics.serviceMonitor.additionalLabels | nindent 4 }} + {{- end }} +spec: + jobName: {{ template "minio.fullname" . }} + {{- if .Values.tls.enabled }} + tlsConfig: + ca: + secret: + name: {{ .Values.tls.certSecret }} + key: {{ .Values.tls.publicCrt }} + serverName: {{ template "minio.fullname" . }} + {{- end }} + prober: + url: {{ template "minio.fullname" . }}.{{ .Release.Namespace }}:{{ .Values.service.port }} + path: /minio/v2/metrics/cluster + {{- if .Values.tls.enabled }} + scheme: https + {{- else }} + scheme: http + {{- end }} + {{- if .Values.metrics.serviceMonitor.relabelConfigsCluster }} + {{- toYaml .Values.metrics.serviceMonitor.relabelConfigsCluster | nindent 2 }} + {{- end }} + targets: + staticConfig: + static: + - {{ template "minio.fullname" . }}.{{ .Release.Namespace }} + {{- if not .Values.metrics.serviceMonitor.public }} + {{- if .Values.metrics.serviceMonitor.interval }} + interval: {{ .Values.metrics.serviceMonitor.interval }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} + scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} + {{- end }} + bearerTokenSecret: + name: {{ template "minio.fullname" . }}-prometheus + key: token + {{- end }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/statefulset.yaml b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/statefulset.yaml new file mode 100644 index 000000000..33f40095d --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/minio/templates/statefulset.yaml @@ -0,0 +1,248 @@ +{{- if eq .Values.mode "distributed" }} +{{ $poolCount := .Values.pools | int }} +{{ $nodeCount := .Values.replicas | int }} +{{ $replicas := mul $poolCount $nodeCount }} +{{ $drivesPerNode := .Values.drivesPerNode | int }} +{{ $scheme := .Values.tls.enabled | ternary "https" "http" }} +{{ $mountPath := .Values.mountPath }} +{{ $bucketRoot := or ($.Values.bucketRoot) ($.Values.mountPath) }} +{{ $subPath := .Values.persistence.subPath }} +{{ $penabled := .Values.persistence.enabled }} +{{ $accessMode := .Values.persistence.accessMode }} +{{ $storageClass := .Values.persistence.storageClass }} +{{ $psize := .Values.persistence.size }} +apiVersion: v1 +kind: Service +metadata: + name: {{ template "minio.fullname" . }}-svc + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + publishNotReadyAddresses: true + clusterIP: None + ports: + - name: {{ $scheme }} + port: {{ .Values.service.port }} + protocol: TCP + targetPort: {{ .Values.minioAPIPort }} + selector: + app: {{ template "minio.name" . }} + release: {{ .Release.Name }} +--- +apiVersion: {{ template "minio.statefulset.apiVersion" . }} +kind: StatefulSet +metadata: + name: {{ template "minio.fullname" . }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- if .Values.additionalLabels }} + {{- toYaml .Values.additionalLabels | nindent 4 }} + {{- end }} + {{- if .Values.additionalAnnotations }} + annotations: {{- toYaml .Values.additionalAnnotations | nindent 4 }} + {{- end }} +spec: + updateStrategy: + type: {{ .Values.statefulSetUpdate.updateStrategy }} + podManagementPolicy: "Parallel" + serviceName: {{ template "minio.fullname" . }}-svc + replicas: {{ $replicas }} + selector: + matchLabels: + app: {{ template "minio.name" . }} + release: {{ .Release.Name }} + template: + metadata: + name: {{ template "minio.fullname" . }} + labels: + app: {{ template "minio.name" . }} + release: {{ .Release.Name }} + {{- if .Values.podLabels }} + {{- toYaml .Values.podLabels | nindent 8 }} + {{- end }} + annotations: + {{- if not .Values.ignoreChartChecksums }} + checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }} + checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} + {{- end }} + {{- if .Values.podAnnotations }} + {{- toYaml .Values.podAnnotations | nindent 8 }} + {{- end }} + spec: + {{- if .Values.priorityClassName }} + priorityClassName: "{{ .Values.priorityClassName }}" + {{- end }} + {{- if .Values.runtimeClassName }} + runtimeClassName: "{{ .Values.runtimeClassName }}" + {{- end }} + {{- if and .Values.securityContext.enabled .Values.persistence.enabled }} + securityContext: + runAsUser: {{ .Values.securityContext.runAsUser }} + runAsGroup: {{ .Values.securityContext.runAsGroup }} + fsGroup: {{ .Values.securityContext.fsGroup }} + {{- if and (ge .Capabilities.KubeVersion.Major "1") (ge .Capabilities.KubeVersion.Minor "20") }} + fsGroupChangePolicy: {{ .Values.securityContext.fsGroupChangePolicy }} + {{- end }} + {{- end }} + {{- if .Values.serviceAccount.create }} + serviceAccountName: {{ .Values.serviceAccount.name }} + {{- end }} + containers: + - name: {{ .Chart.Name }} + image: "{{ default .Values.image.registry (include "registry-url" .) }}{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + command: [ + "/bin/sh", + "-ce", + "/usr/bin/docker-entrypoint.sh minio server {{- range $i := until $poolCount }}{{ $factor := mul $i $nodeCount }}{{ $endIndex := add $factor $nodeCount }}{{ $beginIndex := mul $i $nodeCount }} {{ $scheme }}://{{ template `minio.fullname` $ }}-{{ `{` }}{{ $beginIndex }}...{{ sub $endIndex 1 }}{{ `}`}}.{{ template `minio.fullname` $ }}-svc.{{ $.Release.Namespace }}.svc.{{ $.Values.clusterDomain }}{{if (gt $drivesPerNode 1)}}{{ $bucketRoot }}-{{ `{` }}0...{{ sub $drivesPerNode 1 }}{{ `}` }}{{ else }}{{ $bucketRoot }}{{end }}{{- end }} -S {{ .Values.certsPath }} --address :{{ .Values.minioAPIPort }} --console-address :{{ .Values.minioConsolePort }} {{- template `minio.extraArgs` . }}" + ] + volumeMounts: + {{- if $penabled }} + {{- if (gt $drivesPerNode 1) }} + {{- range $i := until $drivesPerNode }} + - name: export-{{ $i }} + mountPath: {{ $mountPath }}-{{ $i }} + {{- if and $penabled $subPath }} + subPath: {{ $subPath }} + {{- end }} + {{- end }} + {{- else }} + - name: export + mountPath: {{ $mountPath }} + {{- if and $penabled $subPath }} + subPath: {{ $subPath }} + {{- end }} + {{- end }} + {{- end }} + {{- if .Values.extraSecret }} + - name: extra-secret + mountPath: "/tmp/minio-config-env" + {{- end }} + {{- include "minio.tlsKeysVolumeMount" . | indent 12 }} + {{- if .Values.extraVolumeMounts }} + {{- toYaml .Values.extraVolumeMounts | nindent 12 }} + {{- end }} + ports: + - name: {{ $scheme }} + containerPort: {{ .Values.minioAPIPort }} + - name: {{ $scheme }}-console + containerPort: {{ .Values.minioConsolePort }} + env: + - name: MINIO_ROOT_USER + valueFrom: + secretKeyRef: + name: {{ template "minio.secretName" . }} + key: rootUser + - name: MINIO_ROOT_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "minio.secretName" . }} + key: rootPassword + {{- if .Values.extraSecret }} + - name: MINIO_CONFIG_ENV_FILE + value: "/tmp/minio-config-env/config.env" + {{- end }} + {{- if .Values.metrics.serviceMonitor.public }} + - name: MINIO_PROMETHEUS_AUTH_TYPE + value: "public" + {{- end }} + {{- if .Values.oidc.enabled }} + - name: MINIO_IDENTITY_OPENID_CONFIG_URL + value: {{ .Values.oidc.configUrl }} + - name: MINIO_IDENTITY_OPENID_CLIENT_ID + value: {{ .Values.oidc.clientId }} + - name: MINIO_IDENTITY_OPENID_CLIENT_SECRET + value: {{ .Values.oidc.clientSecret }} + - name: MINIO_IDENTITY_OPENID_CLAIM_NAME + value: {{ .Values.oidc.claimName }} + - name: MINIO_IDENTITY_OPENID_CLAIM_PREFIX + value: {{ .Values.oidc.claimPrefix }} + - name: MINIO_IDENTITY_OPENID_SCOPES + value: {{ .Values.oidc.scopes }} + - name: MINIO_IDENTITY_OPENID_REDIRECT_URI + value: {{ .Values.oidc.redirectUri }} + - name: MINIO_IDENTITY_OPENID_COMMENT + value: {{ .Values.oidc.comment }} + {{- end }} + {{- range $key, $val := .Values.environment }} + - name: {{ $key }} + value: {{ tpl $val $ | quote }} + {{- end }} + resources: {{- toYaml .Values.resources | nindent 12 }} + {{- with .Values.extraContainers }} + {{- if eq (typeOf .) "string" }} + {{- tpl . $ | nindent 8 }} + {{- else }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- end }} + nodeSelector: + {{- include "linux-node-selector" . | nindent 8 }} + {{- include "minio.imagePullSecrets" . | indent 6 }} + {{- with .Values.affinity }} + affinity: {{- toYaml . | nindent 8 }} + {{- end }} + tolerations: + {{- include "linux-node-tolerations" . | nindent 8 }} + {{- with .Values.tolerations }} + {{ toYaml . | indent 8 }} + {{- end }} + {{- if and (gt $replicas 1) (ge .Capabilities.KubeVersion.Major "1") (ge .Capabilities.KubeVersion.Minor "19") }} + {{- with .Values.topologySpreadConstraints }} + topologySpreadConstraints: {{- toYaml . | nindent 8 }} + {{- end }} + {{- end }} + volumes: + - name: minio-user + secret: + secretName: {{ template "minio.secretName" . }} + {{- if .Values.extraSecret }} + - name: extra-secret + secret: + secretName: {{ .Values.extraSecret }} + {{- end }} + {{- include "minio.tlsKeysVolume" . | indent 8 }} + {{- if .Values.extraVolumes }} + {{- toYaml .Values.extraVolumes | nindent 8 }} + {{- end }} + {{- if .Values.persistence.enabled }} + volumeClaimTemplates: + {{- if gt $drivesPerNode 1 }} + {{- range $diskId := until $drivesPerNode}} + - metadata: + name: export-{{ $diskId }} + {{- if $.Values.persistence.annotations }} + annotations: {{- toYaml $.Values.persistence.annotations | nindent 10 }} + {{- end }} + spec: + accessModes: [ {{ $accessMode | quote }} ] + {{- if $storageClass }} + storageClassName: {{ $storageClass }} + {{- end }} + resources: + requests: + storage: {{ $psize }} + {{- end }} + {{- else }} + - metadata: + name: export + {{- if $.Values.persistence.annotations }} + annotations: {{- toYaml $.Values.persistence.annotations | nindent 10 }} + {{- end }} + spec: + accessModes: [ {{ $accessMode | quote }} ] + {{- if $storageClass }} + storageClassName: {{ $storageClass }} + {{- end }} + resources: + requests: + storage: {{ $psize }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/minio/values.yaml b/charts/epinio/102.0.4+up1.9.0/charts/minio/values.yaml new file mode 100644 index 000000000..fbdc9be54 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/minio/values.yaml @@ -0,0 +1,542 @@ +## Provide a name in place of minio for `app:` labels +## +nameOverride: "" + +## Provide a name to substitute for the full names of resources +## +fullnameOverride: "" + +## set kubernetes cluster domain where minio is running +## +clusterDomain: cluster.local + +## Set default image, imageTag, and imagePullPolicy. mode is used to indicate the +## +image: + repository: rancher/mirrored-minio-minio + tag: RELEASE.2023-07-07T07-13-57Z + pullPolicy: IfNotPresent + +imagePullSecrets: [] +# - name: "image-pull-secret" + +## Set default image, imageTag, and imagePullPolicy for the `mc` (the minio +## client used to create a default bucket). +## +mcImage: + repository: rancher/mirrored-minio-mc + tag: RELEASE.2023-06-28T21-54-17Z + pullPolicy: IfNotPresent + +## minio mode, i.e. standalone or distributed +mode: distributed ## other supported values are "standalone" + +## Additional labels to include with deployment or statefulset +additionalLabels: {} + +## Additional annotations to include with deployment or statefulset +additionalAnnotations: {} + +## Typically the deployment/statefulset includes checksums of secrets/config, +## So that when these change on a subsequent helm install, the deployment/statefulset +## is restarted. This can result in unnecessary restarts under GitOps tooling such as +## flux, so set to "true" to disable this behaviour. +ignoreChartChecksums: false + +## Additional arguments to pass to minio binary +extraArgs: [] + +## Additional volumes to minio container +extraVolumes: [] + +## Additional volumeMounts to minio container +extraVolumeMounts: [] + +## Additional sidecar containers +extraContainers: [] + +## Internal port number for MinIO S3 API container +## Change service.port to change external port number +minioAPIPort: "9000" + +## Internal port number for MinIO Browser Console container +## Change consoleService.port to change external port number +minioConsolePort: "9001" + +## Update strategy for Deployments +deploymentUpdate: + type: RollingUpdate + maxUnavailable: 0 + maxSurge: 100% + +## Update strategy for StatefulSets +statefulSetUpdate: + updateStrategy: RollingUpdate + +## Pod priority settings +## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ +## +priorityClassName: "" + +## Pod runtime class name +## ref https://kubernetes.io/docs/concepts/containers/runtime-class/ +## +runtimeClassName: "" + +## Set default rootUser, rootPassword +## AccessKey and secretKey is generated when not set +## Distributed MinIO ref: https://min.io/docs/minio/linux/operations/install-deploy-manage/deploy-minio-multi-node-multi-drive.html +## +rootUser: "" +rootPassword: "" + +## Use existing Secret that store following variables: +## +## | Chart var | .data. in Secret | +## |:----------------------|:-------------------------| +## | rootUser | rootUser | +## | rootPassword | rootPassword | +## +## All mentioned variables will be ignored in values file. +## .data.rootUser and .data.rootPassword are mandatory, +## others depend on enabled status of corresponding sections. +existingSecret: "" + +## Directory on the MinIO pof +certsPath: "/etc/minio/certs/" +configPathmc: "/etc/minio/mc/" + +## Path where PV would be mounted on the MinIO Pod +mountPath: "/export" +## Override the root directory which the minio server should serve from. +## If left empty, it defaults to the value of {{ .Values.mountPath }} +## If defined, it must be a sub-directory of the path specified in {{ .Values.mountPath }} +## +bucketRoot: "" + +# Number of drives attached to a node +drivesPerNode: 1 +# Number of MinIO containers running +replicas: 16 +# Number of expanded MinIO clusters +pools: 1 + +## TLS Settings for MinIO +tls: + enabled: false + ## Create a secret with private.key and public.crt files and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret + certSecret: "" + publicCrt: public.crt + privateKey: private.key + +## Trusted Certificates Settings for MinIO. Ref: https://min.io/docs/minio/linux/operations/network-encryption.html#third-party-certificate-authorities +## Bundle multiple trusted certificates into one secret and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret +## When using self-signed certificates, remember to include MinIO's own certificate in the bundle with key public.crt. +## If certSecret is left empty and tls is enabled, this chart installs the public certificate from .Values.tls.certSecret. +trustedCertsSecret: "" + +## Enable persistence using Persistent Volume Claims +## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ +## +persistence: + enabled: true + annotations: {} + + ## A manually managed Persistent Volume and Claim + ## Requires persistence.enabled: true + ## If defined, PVC must be created manually before volume will be bound + existingClaim: "" + + ## minio data Persistent Volume Storage Class + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## + ## Storage class of PV to bind. By default it looks for standard storage class. + ## If the PV uses a different storage class, specify that here. + storageClass: "" + volumeName: "" + accessMode: ReadWriteOnce + size: 500Gi + + ## If subPath is set mount a sub folder of a volume instead of the root of the volume. + ## This is especially handy for volume plugins that don't natively support sub mounting (like glusterfs). + ## + subPath: "" + +## Expose the MinIO service to be accessed from outside the cluster (LoadBalancer service). +## or access it from within the cluster (ClusterIP service). Set the service type and the port to serve it. +## ref: http://kubernetes.io/docs/user-guide/services/ +## +service: + type: ClusterIP + clusterIP: ~ + port: "9000" + nodePort: 32000 + loadBalancerIP: ~ + externalIPs: [] + annotations: {} + +## Configure Ingress based on the documentation here: https://kubernetes.io/docs/concepts/services-networking/ingress/ +## + +ingress: + enabled: false + ingressClassName: ~ + labels: {} + # node-role.kubernetes.io/ingress: platform + annotations: {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + # kubernetes.io/ingress.allow-http: "false" + # kubernetes.io/ingress.global-static-ip-name: "" + # nginx.ingress.kubernetes.io/secure-backends: "true" + # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" + # nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0 + path: / + hosts: + - minio-example.local + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + +consoleService: + type: ClusterIP + clusterIP: ~ + port: "9001" + nodePort: 32001 + loadBalancerIP: ~ + externalIPs: [] + annotations: {} + +consoleIngress: + enabled: false + ingressClassName: ~ + labels: {} + # node-role.kubernetes.io/ingress: platform + annotations: {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + # kubernetes.io/ingress.allow-http: "false" + # kubernetes.io/ingress.global-static-ip-name: "" + # nginx.ingress.kubernetes.io/secure-backends: "true" + # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" + # nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0 + path: / + hosts: + - console.minio-example.local + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + +## Node labels for pod assignment +## Ref: https://kubernetes.io/docs/user-guide/node-selection/ +## +nodeSelector: {} +tolerations: [] +affinity: {} +topologySpreadConstraints: [] + +## Add stateful containers to have security context, if enabled MinIO will run as this +## user and group NOTE: securityContext is only enabled if persistence.enabled=true +securityContext: + enabled: true + runAsUser: 1000 + runAsGroup: 1000 + fsGroup: 1000 + fsGroupChangePolicy: "OnRootMismatch" + +# Additational pod annotations +podAnnotations: {} + +# Additional pod labels +podLabels: {} + +## Configure resource requests and limits +## ref: http://kubernetes.io/docs/user-guide/compute-resources/ +## +resources: + requests: + memory: 16Gi + +## List of policies to be created after minio install +## +## In addition to default policies [readonly|readwrite|writeonly|consoleAdmin|diagnostics] +## you can define additional policies with custom supported actions and resources +policies: [] +## writeexamplepolicy policy grants creation or deletion of buckets with name +## starting with example. In addition, grants objects write permissions on buckets starting with +## example. +# - name: writeexamplepolicy +# statements: +# - resources: +# - 'arn:aws:s3:::example*/*' +# actions: +# - "s3:AbortMultipartUpload" +# - "s3:GetObject" +# - "s3:DeleteObject" +# - "s3:PutObject" +# - "s3:ListMultipartUploadParts" +# - resources: +# - 'arn:aws:s3:::example*' +# actions: +# - "s3:CreateBucket" +# - "s3:DeleteBucket" +# - "s3:GetBucketLocation" +# - "s3:ListBucket" +# - "s3:ListBucketMultipartUploads" +## readonlyexamplepolicy policy grants access to buckets with name starting with example. +## In addition, grants objects read permissions on buckets starting with example. +# - name: readonlyexamplepolicy +# statements: +# - resources: +# - 'arn:aws:s3:::example*/*' +# actions: +# - "s3:GetObject" +# - resources: +# - 'arn:aws:s3:::example*' +# actions: +# - "s3:GetBucketLocation" +# - "s3:ListBucket" +# - "s3:ListBucketMultipartUploads" +## conditionsexample policy creates all access to example bucket with aws:username="johndoe" and source ip range 10.0.0.0/8 and 192.168.0.0/24 only +# - name: conditionsexample +# statements: +# - resources: +# - 'arn:aws:s3:::example/*' +# actions: +# - 's3:*' +# conditions: +# - StringEquals: '"aws:username": "johndoe"' +# - IpAddress: | +# "aws:SourceIp": [ +# "10.0.0.0/8", +# "192.168.0.0/24" +# ] +# +## Additional Annotations for the Kubernetes Job makePolicyJob +makePolicyJob: + securityContext: + enabled: false + runAsUser: 1000 + runAsGroup: 1000 + resources: + requests: + memory: 128Mi + # Command to run after the main command on exit + exitCommand: "" + +## List of users to be created after minio install +## +users: + ## Username, password and policy to be assigned to the user + ## Default policies are [readonly|readwrite|writeonly|consoleAdmin|diagnostics] + ## Add new policies as explained here https://min.io/docs/minio/kubernetes/upstream/administration/identity-access-management.html#access-management + ## NOTE: this will fail if LDAP is enabled in your MinIO deployment + ## make sure to disable this if you are using LDAP. + - accessKey: console + secretKey: console123 + policy: consoleAdmin + # Or you can refer to specific secret + #- accessKey: externalSecret + # existingSecret: my-secret + # existingSecretKey: password + # policy: readonly + +## Additional Annotations for the Kubernetes Job makeUserJob +makeUserJob: + securityContext: + enabled: false + runAsUser: 1000 + runAsGroup: 1000 + resources: + requests: + memory: 128Mi + # Command to run after the main command on exit + exitCommand: "" + +## List of service accounts to be created after minio install +## +svcaccts: [] + ## accessKey, secretKey and parent user to be assigned to the service accounts + ## Add new service accounts as explained here https://min.io/docs/minio/kubernetes/upstream/administration/identity-access-management/minio-user-management.html#service-accounts + # - accessKey: console-svcacct + # secretKey: console123 + # user: console + ## Or you can refer to specific secret + # - accessKey: externalSecret + # existingSecret: my-secret + # existingSecretKey: password + # user: console + ## You also can pass custom policy + # - accessKey: console-svcacct + # secretKey: console123 + # user: console + # policy: + # statements: + # - resources: + # - 'arn:aws:s3:::example*/*' + # actions: + # - "s3:AbortMultipartUpload" + # - "s3:GetObject" + # - "s3:DeleteObject" + # - "s3:PutObject" + # - "s3:ListMultipartUploadParts" + +makeServiceAccountJob: + securityContext: + enabled: false + runAsUser: 1000 + runAsGroup: 1000 + resources: + requests: + memory: 128Mi + # Command to run after the main command on exit + exitCommand: "" + +## List of buckets to be created after minio install +## +buckets: [] + # # Name of the bucket + # - name: bucket1 + # # Policy to be set on the + # # bucket [none|download|upload|public] + # policy: none + # # Purge if bucket exists already + # purge: false + # # set versioning for + # # bucket [true|false] + # versioning: false + # # set objectlocking for + # # bucket [true|false] NOTE: versioning is enabled by default if you use locking + # objectlocking: false + # - name: bucket2 + # policy: none + # purge: false + # versioning: true + # # set objectlocking for + # # bucket [true|false] NOTE: versioning is enabled by default if you use locking + # objectlocking: false + +## Additional Annotations for the Kubernetes Job makeBucketJob +makeBucketJob: + securityContext: + enabled: false + runAsUser: 1000 + runAsGroup: 1000 + resources: + requests: + memory: 128Mi + # Command to run after the main command on exit + exitCommand: "" + +## List of command to run after minio install +## NOTE: the mc command TARGET is always "myminio" +customCommands: + # - command: "admin policy attach myminio consoleAdmin --group='cn=ops,cn=groups,dc=example,dc=com'" + +## Additional Annotations for the Kubernetes Job customCommandJob +customCommandJob: + securityContext: + enabled: false + runAsUser: 1000 + runAsGroup: 1000 + resources: + requests: + memory: 128Mi + # Command to run after the main command on exit + exitCommand: "" + +## Merge jobs +postJob: + podAnnotations: {} + annotations: {} + securityContext: + enabled: false + runAsUser: 1000 + runAsGroup: 1000 + fsGroup: 1000 + nodeSelector: {} + tolerations: [] + affinity: {} + +## Use this field to add environment variables relevant to MinIO server. These fields will be passed on to MinIO container(s) +## when Chart is deployed +environment: + ## Please refer for comprehensive list https://min.io/docs/minio/linux/reference/minio-server/minio-server.html + ## MINIO_SUBNET_LICENSE: "License key obtained from https://subnet.min.io" + ## MINIO_BROWSER: "off" + +## The name of a secret in the same kubernetes namespace which contain secret values +## This can be useful for LDAP password, etc +## The key in the secret must be 'config.env' +## +extraSecret: ~ + +## OpenID Identity Management +## The following section documents environment variables for enabling external identity management using an OpenID Connect (OIDC)-compatible provider. +## See https://min.io/docs/minio/linux/operations/external-iam/configure-openid-external-identity-management.html for a tutorial on using these variables. +oidc: + enabled: false + configUrl: "https://identity-provider-url/.well-known/openid-configuration" + clientId: "minio" + clientSecret: "" + claimName: "policy" + scopes: "openid,profile,email" + redirectUri: "https://console-endpoint-url/oauth_callback" + # Can leave empty + claimPrefix: "" + comment: "" + +networkPolicy: + enabled: false + allowExternal: true + +## PodDisruptionBudget settings +## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ +## +podDisruptionBudget: + enabled: false + maxUnavailable: 1 + +## Specify the service account to use for the MinIO pods. If 'create' is set to 'false' +## and 'name' is left unspecified, the account 'default' will be used. +serviceAccount: + create: true + ## The name of the service account to use. If 'create' is 'true', a service account with that name + ## will be created. + name: "minio-sa" + +metrics: + serviceMonitor: + enabled: false + # scrape each node/pod individually for additional metrics + includeNode: false + public: true + additionalLabels: {} + annotations: {} + # for node metrics + relabelConfigs: {} + # for cluster metrics + relabelConfigsCluster: {} + # metricRelabelings: + # - regex: (server|pod) + # action: labeldrop + namespace: ~ + # Scrape interval, for example `interval: 30s` + interval: ~ + # Scrape timeout, for example `scrapeTimeout: 10s` + scrapeTimeout: ~ + +## ETCD settings: https://github.com/minio/minio/blob/master/docs/sts/etcd.md +## Define endpoints to enable this section. +etcd: + endpoints: [] + pathPrefix: "" + corednsPathPrefix: "" + clientCert: "" + clientCertKey: "" diff --git a/charts/epinio/102.0.4+up1.9.0/charts/s3gw/Chart.yaml b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/Chart.yaml new file mode 100644 index 000000000..2f7e74045 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/Chart.yaml @@ -0,0 +1,23 @@ +annotations: + app.aquarist-labs.io/name: s3gw +apiVersion: v2 +appVersion: latest +description: 'Easy-to-use Open Source and Cloud Native S3 service for use on Rancher''s + Kubernetes. ' +home: https://github.com/aquarist-labs/s3gw +icon: https://raw.githubusercontent.com/aquarist-labs/aquarium-website/gh-pages/images/logo-xl.png +keywords: +- storage +- s3 +kubeVersion: '>=1.14' +maintainers: +- email: s3gw@suse.com + name: s3gw maintainers + url: https://github.com/orgs/aquarist-labs/projects/5 +name: s3gw +sources: +- https://github.com/aquarist-labs/s3gw-charts +- https://github.com/aquarist-labs/s3gw +- https://github.com/aquarist-labs/ceph +type: application +version: 0.14.0 diff --git a/charts/epinio/102.0.4+up1.9.0/charts/s3gw/README.md b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/README.md new file mode 100644 index 000000000..33fc51ad3 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/README.md @@ -0,0 +1,61 @@ +# [s3gw][s3gw-url] + +s3gw is an S3-compatible service focused on deployments in a Kubernetes +environment backed by any PVC, including Longhorn. Since its inception, the +primary focus has been on cloud native deployments. However, the s3gw can be +deployed in a myriad of scenarios, provided some form of storage is attached. + +s3gw is based on Ceph’s RADOSGW (RGW) but runs as a stand–alone service without +the RADOS cluster and relies on a storage backend still under heavy development +by the storage team at SUSE. A web-based UI for management and an object +explorer are also part of s3gw. + +## Quickstart + +To install s3gw using Helm add the chart to your Helm repository and then run +`helm install`: + +```bash +helm add repo s3gw https://aquarist-labs.github.io/s3gw-charts/ +helm \ + --namespace s3gw-system \ + install s3gw \ + s3gw/s3gw \ + --create-namespace \ + -f /path/to/your/custom/values.yaml +``` + +## Rancher + +Installing s3gw via the Rancher App Catalog is made easy, the steps are as +follows: + +- Cluster -> Projects/Namespaces - create the `s3gw` namespace. +- Apps -> Repositories -> Create `s3gw` using the s3gw-charts Git URL + and the `main` branch. +- Apps -> Charts -> Install `Traefik`. +- Apps -> Charts -> Install `s3gw`. Select the `s3gw` namespace previously + created. A `pvc` for `s3gw` will be created automatically during installation. + +## Documentation + +You can access our documentation [here][docs-url]. + +## License + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use licensed files except in compliance with the License. +You may obtain a copy of the License at + + + +or the LICENSE file in this repository. + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. + +[s3gw-url]: https://s3gw.io +[docs-url]: https://s3gw-docs.readthedocs.io/en/latest/helm-charts/ diff --git a/charts/epinio/102.0.4+up1.9.0/charts/s3gw/app-readme.md b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/app-readme.md new file mode 100644 index 000000000..3ad286f2a --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/app-readme.md @@ -0,0 +1,16 @@ +# s3gw + +s3gw is an easy-to-use Open Source and Cloud Native S3 service running on +Rancher's Kubernetes. + +* It complements the Rancher portfolio by offering an S3 service for Longhorn + volume backups, Harvester backups, Epinio backups and OPNI models. +* It is deployed on a single pod, ideal for development, Edge, IoT and smaller + on-prem deployments. +* It leverages the feature-rich S3 gateway from Ceph but without the rest of + the Ceph stack. + +For more information, see the [manual][1] and the [chart documentation][2]. + +[1]: https://s3gw-docs.readthedocs.io +[2]: https://github.com/aquarist-labs/s3gw-charts/blob/main/README.md diff --git a/charts/epinio/102.0.4+up1.9.0/charts/s3gw/questions.yaml b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/questions.yaml new file mode 100644 index 000000000..5733cbf86 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/questions.yaml @@ -0,0 +1,293 @@ +--- +questions: + # General settings + + - variable: useCertManager + label: Use cert-manager + default: "true" + description: "Use cert-manager to provision TLS certificates" + type: boolean + group: "General" + + - variable: tls.publicDomain.crt + show_if: "useCertManager=false" + description: "S3 TLS certificate (Public Domain)" + label: "S3 TLS certificate (Public Domain)" + type: string + group: "General" + + - variable: tls.publicDomain.key + show_if: "useCertManager=false" + description: "S3 TLS key (Public Domain)" + label: "S3 TLS key (Public Domain)" + type: string + group: "General" + + - variable: tls.privateDomain.crt + show_if: "useCertManager=false" + description: "S3 TLS certificate (Private Domain)" + label: "S3 TLS certificate (Private Domain)" + type: string + group: "General" + + - variable: tls.privateDomain.key + show_if: "useCertManager=false" + description: "S3 TLS key (Private Domain)" + label: "S3 TLS key (Private Domain)" + type: string + group: "General" + + - variable: tls.ui.publicDomain.crt + show_if: "useCertManager=false" + description: "UI TLS certificate" + label: "UI TLS certificate" + type: string + group: "General" + + - variable: tls.ui.publicDomain.key + show_if: "useCertManager=false" + description: "UI TLS key" + label: "UI TLS key" + type: string + group: "General" + + - variable: certManagerNamespace + show_if: "useCertManager=true" + label: cert-manager's namespace + default: "cert-manager" + description: "cert-manager's namespace" + type: string + required: false + + - variable: useCustomTlsIssuer + show_if: "useCertManager=true" + label: Use your own TLS issuer + default: "false" + description: "Use your own TLS issuer" + type: boolean + group: "General" + show_subquestion_if: true + subquestions: + - variable: customTlsIssuer + label: Custom TLS issuer + description: "Name of the custom TLS issuer to use" + type: string + required: false + + - variable: tlsIssuer + show_if: "useCertManager=true&&useCustomTlsIssuer=false" + label: TLS issuer + description: "Name of the predefined TLS issuer to use" + type: enum + required: false + group: "General" + options: + - "s3gw-issuer" + - "s3gw-letsencrypt-issuer" + + - variable: email + show_if: "useCertManager=true&&tlsIssuer=s3gw-letsencrypt-issuer" + label: email address to use with s3gw-letsencrypt-issuer + description: "email address to use with s3gw-letsencrypt-issuer" + type: string + required: false + group: "General" + + - variable: serviceName + default: s3gw + description: "S3 Service Name" + label: "S3 Service Name" + required: true + type: string + group: "General" + + - variable: defaultUserCredentialsSecret + default: s3gw-creds + description: | + "The name of the secret containing the + S3 credentials for the default user" + type: string + group: "General" + + - variable: useExistingSecret + default: false + description: | + "Check this to use a preexisting secret + containing the S3 credentials for the default user" + type: boolean + group: "General" + + - variable: accessKey + show_if: "useExistingSecret=false" + default: test + description: | + "Set this as the empty string to make the Chart + to compute a random alphanumeric value" + label: "S3 Access Key" + type: string + group: "General" + + - variable: secretKey + show_if: "useExistingSecret=false" + default: test + description: | + "Set this as the empty string to make the Chart + to compute a random alphanumeric value" + label: "S3 Secret Key" + type: string + group: "General" + + - variable: ingress.enabled + default: true + description: "Deploy an Ingress (Required for TLS and UI)" + label: "Enable Ingress" + required: true + type: boolean + group: "General" + + - variable: publicDomain + show_if: ingress.enabled=true + default: be.127.0.0.1.omg.howdoi.website + description: "Public domain of the S3 Service used by the Ingress" + label: "Public Domain" + required: true + type: string + group: "General" + + - variable: privateDomain + default: svc.cluster.local + description: "Private domain of the S3 Service used inside the Kubernetes cluster" + label: "Private Domain" + required: true + type: string + group: "General" + + - variable: ui.enabled + default: false + description: "UI Enabled" + label: "UI Enabled" + required: true + type: boolean + group: "General" + + - variable: ui.serviceName + default: s3gw-ui + description: "UI Service Name" + label: "UI Service Name" + required: true + type: string + group: "General" + + - variable: ui.publicDomain + show_if: ingress.enabled=true + default: fe.127.0.0.1.omg.howdoi.website + description: "Public domain of the UI Service used by the Ingress" + label: "UI Public Domain" + required: true + type: string + group: "General" + + # Storage + - variable: storageSize + description: "Storage Size" + type: string + default: 10Gi + label: "Storage Size" + group: "Storage" + + - variable: storageClass.name + description: "Storage Class Name" + type: string + default: "longhorn-single" + required: true + label: "Storage Class" + group: "Storage" + + - variable: storageClass.create + description: | + Create a new opinionated storage class backed by longhorn.io + type: boolean + default: true + label: "Create Storage Class" + group: "Storage" + + # Advanced Options + - variable: imageRegistry + default: + description: "Image Registry" + label: "Image Registry" + required: false + type: string + group: "Advanced" + + - variable: imageCredentials.username + default: + description: "Registry Username" + label: "Username" + required: false + type: string + group: "Advanced" + + - variable: imageCredentials.password + default: + description: "Registry Password" + label: "Password" + required: false + type: string + group: "Advanced" + + - variable: imageCredentials.email + default: + description: "Registry Email" + label: "Email" + required: false + type: string + group: "Advanced" + + - variable: imagePullPolicy + default: + description: "Image Pull Policy" + label: "Image Pull Policy" + required: false + type: string + group: "Advanced" + + - variable: imageName + default: + description: "Gateway Image Name" + label: "Image Name" + required: false + type: string + group: "Advanced" + + - variable: imageTag + default: + description: "Image Tag" + label: "Image Tag" + required: false + type: string + group: "Advanced" + + - variable: ui.imageName + default: + description: "UI Image Name" + label: "UI Image Name" + required: false + type: string + group: "Advanced" + + - variable: ui.imageTag + default: + description: "UI Image Tag" + label: "UI Image Tag" + required: false + type: string + group: "Advanced" + + - variable: logLevel + default: "1" + description: "s3gw pod log level, lower values are less verbose" + label: "s3gw pod log level" + required: false + type: string + group: "Advanced" diff --git a/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/NOTES.txt b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/NOTES.txt new file mode 100644 index 000000000..d27381295 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/NOTES.txt @@ -0,0 +1,16 @@ +Thank you for installing {{ .Chart.Name }} {{ printf "v%s" .Chart.Version }} + +The S3 endpoint is available at: + +{{ printf "%s.%s" .Values.serviceName .Values.publicDomain | indent 4 }} +{{ if .Values.ui.enabled}} +and the web interface is available at: + +{{ printf "%s.%s" .Values.ui.serviceName .Values.ui.publicDomain | indent 4 }} +{{- end }} +{{ if and (not .Values.useExistingSecret) (empty .Values.accessKey) }} +An access key has been generated: {{ include "s3gw.defaultAccessKey" . | quote }} +{{- end }} +{{- if and (not .Values.useExistingSecret) (empty .Values.secretKey) }} +A secret key has been generated: {{ include "s3gw.defaultSecretKey" . | quote }} +{{ end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/_helpers.tpl b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/_helpers.tpl new file mode 100644 index 000000000..4afd68475 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/_helpers.tpl @@ -0,0 +1,140 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "s3gw.name" -}} +{{- .Chart.Name }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "s3gw.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "s3gw.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "s3gw.labels" -}} +helm.sh/chart: {{ include "s3gw.chart" . }} +{{ include "s3gw.commonSelectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{- define "s3gw.commonSelectorLabels" -}} +app.kubernetes.io/name: {{ include "s3gw.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{- define "s3gw.selectorLabels" -}} +{{ include "s3gw.commonSelectorLabels" . }} +app.kubernetes.io/component: gateway +{{- end }} + +{{- define "s3gw-ui.selectorLabels" -}} +{{ include "s3gw.commonSelectorLabels" . }} +app.kubernetes.io/component: ui +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "s3gw.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "s3gw.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{/* +Version helpers for the image tag +*/}} +{{- define "s3gw.image" -}} +{{- $defaulttag := printf "v%s" .Chart.Version }} +{{- $tag := default $defaulttag .Values.image.tag }} +{{- $name := default "s3gw/s3gw" .Values.image.repository }} +{{- $registry := include "registry-url" . }} +{{- printf "%s%s:%s" $registry $name $tag }} +{{- end }} + +{{- define "s3gw-ui.image" -}} +{{- $tag := default (printf "v%s" .Chart.Version) .Values.ui.image.tag }} +{{- $name := default "s3gw/s3gw-ui" .Values.ui.image.repository }} +{{- $registry := include "registry-url" . }} +{{- printf "%s%s:%s" $registry $name $tag }} +{{- end }} + +{{/* +Image Pull Secret +*/}} +{{- define "s3gw.imagePullSecret" -}} +{{- $un := .Values.imageCredentials.username }} +{{- $pw := .Values.imageCredentials.password }} +{{- $em := .Values.imageCredentials.email }} +{{- $rg := include "registry-url" . }} +{{- $au := (printf "%s:%s" $un $pw | b64enc) }} +{{- printf "{\"auths\":{\"%s\":{\"username\":\"%s\",\"password\":\"%s\",\"email\":\"%s\",\"auth\":\"%s\"}}}" $rg $un $pw $em $au | b64enc}} +{{- end }} + + +{{/* +Default Access Credentials +*/}} +{{- define "s3gw.defaultAccessKey" -}} +{{- $key := default (randAlphaNum 32) .Values.accessKey }} +{{- printf "%s" $key }} +{{- end }} +{{- define "s3gw.defaultSecretKey" -}} +{{- $key := default (randAlphaNum 32) .Values.secretKey }} +{{- printf "%s" $key }} +{{- end }} + +{{/* +Windows cluster will add default taint for linux nodes, add below linux tolerations to +workloads could be scheduled to those linux nodes +*/}} +{{- define "linux-node-tolerations" -}} +- key: "cattle.io/os" + value: "linux" + effect: "NoSchedule" + operator: "Equal" +{{- end -}} + +{{- define "linux-node-selector" -}} +{{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}} +beta.kubernetes.io/os: linux +{{- else -}} +kubernetes.io/os: linux +{{- end -}} +{{- end -}} + +{{/* +URL prefix for container images to be compatible with Rancher +*/}} +{{- define "registry-url" -}} +{{- if .Values.global.cattle.systemDefaultRegistry -}} +{{ trimSuffix "/" .Values.global.cattle.systemDefaultRegistry }}/ +{{- end -}} +{{- end -}} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/certificate.yaml b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/certificate.yaml new file mode 100644 index 000000000..e44a3380c --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/certificate.yaml @@ -0,0 +1,38 @@ +{{- if .Values.useCertManager }} +--- +# s3gw-ca root certificate +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: s3gw-ca-cert + namespace: {{ .Values.certManagerNamespace }} + labels: +{{ include "s3gw.labels" . | indent 4}} +spec: + commonName: s3gw-ca + isCA: true + issuerRef: + kind: ClusterIssuer + name: s3gw-self-signed-issuer + privateKey: + algorithm: ECDSA + size: 256 + secretName: s3gw-ca-root +--- +# s3gw internal service certificate (private domain) +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: s3gw-cluster-ip-cert + namespace: {{ .Release.Namespace }} + labels: +{{ include "s3gw.labels" . | indent 4}} +spec: + dnsNames: + - '{{ .Values.serviceName }}.{{ .Release.Namespace }}.{{ .Values.privateDomain }}' + - '*.{{ .Values.serviceName }}.{{ .Release.Namespace }}.{{ .Values.privateDomain }}' + issuerRef: + kind: ClusterIssuer + name: s3gw-issuer + secretName: s3gw-cluster-ip-tls +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/configmap.yaml b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/configmap.yaml new file mode 100644 index 000000000..c6f27c9ba --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/configmap.yaml @@ -0,0 +1,13 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: s3gw-config + namespace: {{ .Release.Namespace }} + labels: +{{ include "s3gw.labels" . | indent 4}} +data: +{{- if .Values.ui.enabled }} + RGW_SERVICE_URL: 'https://{{ .Values.serviceName }}.{{ .Values.publicDomain }}' +{{- end }} + RGW_DEFAULT_USER_SYSTEM: "1" diff --git a/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/deployment.yaml b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/deployment.yaml new file mode 100644 index 000000000..d67f6ca54 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/deployment.yaml @@ -0,0 +1,111 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ .Chart.Name }} + namespace: {{ .Release.Namespace }} + labels: +{{ include "s3gw.labels" . | indent 4 }} +spec: + replicas: 1 + selector: + matchLabels: +{{ include "s3gw.selectorLabels" . | indent 6 }} + strategy: + type: Recreate + template: + metadata: + labels: +{{ include "s3gw.selectorLabels" . | indent 8 }} + spec: +{{- if .Values.imageCredentials }} + imagePullSecrets: + - name: {{ .Chart.Name }}-image-pull-secret +{{- end }} + serviceAccountName: {{ include "s3gw.serviceAccountName" . }} + containers: + - name: {{ .Chart.Name }} + image: {{ include "s3gw.image" . | quote }} + imagePullPolicy: {{ default "IfNotPresent" .Values.imagePullPolicy }} + args: + - "--rgw-dns-name" +{{- if .Values.ingress.enabled }} + - {{ .Values.serviceName }}.{{ .Values.publicDomain }}, + {{ .Values.serviceName }}.{{ .Release.Namespace }}.{{ .Values.privateDomain }} +{{- else}} + - {{ .Values.serviceName }}.{{ .Release.Namespace }}.{{ .Values.privateDomain }} +{{- end }} + - "--rgw-backend-store" + - sfs + - "--debug-rgw" + - '{{ .Values.logLevel }}' + - "--rgw_frontends" + - "beast port=7480 ssl_port=7481 + ssl_certificate=/s3gw-cluster-ip-tls/tls.crt + ssl_private_key=/s3gw-cluster-ip-tls/tls.key" + ports: + - containerPort: 7480 + name: s3 + - containerPort: 7481 + name: s3-tls + envFrom: + - secretRef: + name: {{ .Values.defaultUserCredentialsSecret }} + volumeMounts: + - name: s3gw-lh-store + mountPath: /data + - name: s3gw-cluster-ip-tls + mountPath: /s3gw-cluster-ip-tls + nodeSelector: + {{- include "linux-node-selector" . | nindent 8 }} + tolerations: + {{- include "linux-node-tolerations" . | nindent 8 }} + volumes: + - name: s3gw-lh-store + persistentVolumeClaim: + claimName: {{ .Release.Name }}-pvc + - name: s3gw-cluster-ip-tls + secret: + secretName: s3gw-cluster-ip-tls + optional: false +{{- if .Values.ui.enabled }} +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: '{{ .Chart.Name }}-ui' + namespace: {{ .Release.Namespace }} + labels: +{{ include "s3gw.labels" . | indent 4 }} +spec: + replicas: 1 + selector: + matchLabels: +{{ include "s3gw-ui.selectorLabels" . | indent 6 }} + strategy: {} + template: + metadata: + labels: +{{ include "s3gw-ui.selectorLabels" . | indent 8}} + spec: +{{- if .Values.imageCredentials }} + imagePullSecrets: + - name: {{ .Chart.Name }}-image-pull-secret +{{- end }} + serviceAccountName: {{ include "s3gw.serviceAccountName" . }} + containers: + - name: s3gw-ui + image: {{ include "s3gw-ui.image" . | quote }} + imagePullPolicy: {{ default "IfNotPresent" .Values.ui.imagePullPolicy }} + ports: + - containerPort: 8080 + envFrom: + - configMapRef: + name: s3gw-config + - secretRef: + name: {{ .Values.defaultUserCredentialsSecret }} + nodeSelector: + {{- include "linux-node-selector" . | nindent 8 }} + tolerations: + {{- include "linux-node-tolerations" . | nindent 8 }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/ingress-traefik.yaml b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/ingress-traefik.yaml new file mode 100644 index 000000000..094ddc67a --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/ingress-traefik.yaml @@ -0,0 +1,157 @@ +{{- if .Values.ingress.enabled }} +--- +# S3 Ingress +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: '{{ .Chart.Name }}' + namespace: {{ .Release.Namespace }} + labels: +{{ include "s3gw.labels" . | indent 4 }} + annotations: + traefik.ingress.kubernetes.io/router.tls: "true" + traefik.ingress.kubernetes.io/router.middlewares: + '{{ .Release.Namespace }}-cors-header@kubernetescrd' + cert-manager.io/cluster-issuer: {{ default .Values.tlsIssuer .Values.customTlsIssuer | quote }} +spec: + tls: + - hosts: + - '{{ .Values.serviceName }}.{{ .Values.publicDomain }}' + - '*.{{ .Values.serviceName }}.{{ .Values.publicDomain }}' + secretName: s3gw-ingress-tls + rules: + - host: '{{ .Values.serviceName }}.{{ .Values.publicDomain }}' + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: '{{ .Values.serviceName }}' + port: + number: 80 + - host: '*.{{ .Values.serviceName }}.{{ .Values.publicDomain }}' + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: '{{ .Values.serviceName }}' + port: + number: 80 +--- +# S3 No TLS Ingress +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: '{{ .Chart.Name }}-no-tls' + namespace: {{ .Release.Namespace }} + labels: +{{ include "s3gw.labels" . | indent 4 }} + annotations: + traefik.ingress.kubernetes.io/router.middlewares: + '{{ .Release.Namespace }}-cors-header@kubernetescrd' +spec: + rules: + - host: '{{ .Values.serviceName }}.{{ .Values.publicDomain }}' + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: '{{ .Values.serviceName }}' + port: + number: 80 + - host: '*.{{ .Values.serviceName }}.{{ .Values.publicDomain }}' + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: '{{ .Values.serviceName }}' + port: + number: 80 +{{- if .Values.ui.enabled }} +--- +# UI Ingress +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: '{{ .Chart.Name }}-ui' + namespace: {{ .Release.Namespace }} + labels: +{{ include "s3gw.labels" . | indent 4 }} + annotations: + traefik.ingress.kubernetes.io/router.tls: "true" + traefik.ingress.kubernetes.io/router.middlewares: + '{{ .Release.Namespace }}-cors-header@kubernetescrd' + cert-manager.io/cluster-issuer: {{ default .Values.tlsIssuer .Values.customTlsIssuer | quote }} +spec: + tls: + - hosts: + - '{{ .Values.ui.serviceName }}.{{ .Values.ui.publicDomain }}' + secretName: s3gw-ui-ingress-tls + rules: + - host: '{{ .Values.ui.serviceName }}.{{ .Values.ui.publicDomain }}' + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: '{{ .Values.ui.serviceName }}' + port: + number: 80 +--- +# UI No TLS Ingress +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: '{{ .Chart.Name }}-ui-no-tls' + namespace: {{ .Release.Namespace }} + labels: +{{ include "s3gw.labels" . | indent 4 }} + annotations: + traefik.ingress.kubernetes.io/router.middlewares: + '{{ .Release.Namespace }}-cors-header@kubernetescrd' +spec: + rules: + - host: '{{ .Values.ui.serviceName }}.{{ .Values.ui.publicDomain }}' + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: '{{ .Values.ui.serviceName }}' + port: + number: 80 +{{- end }} +--- +# Middleware for Traefik +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: cors-header + namespace: {{ .Release.Namespace }} + labels: +{{ include "s3gw.labels" . | indent 4 }} +spec: + headers: + accessControlAllowMethods: + - "DELETE" + - "GET" + - "HEAD" + - "POST" + - "PUT" + - "OPTIONS" + accessControlAllowOriginList: + - "*" + accessControlAllowHeaders: + - "*" + accessControlExposeHeaders: + - "*" +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/psp.yaml b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/psp.yaml new file mode 100644 index 000000000..f48bb0004 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/psp.yaml @@ -0,0 +1,86 @@ +{{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy" -}} +{{- if .Values.serviceAccount.create }} +{{- if .Values.global.rbac.pspEnabled }} + +--- +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: {{ include "s3gw.serviceAccountName" . }}-psp + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: "{{ replace "+" "_" .Chart.Version }}" + app.kubernetes.io/part-of: {{ include "s3gw.serviceAccountName" . }} + app: {{ include "s3gw.serviceAccountName" . }} +{{- if .Values.global.rbac.pspAnnotations }} + annotations: {{ toYaml .Values.global.rbac.pspAnnotations | nindent 4 }} +{{- end }} +spec: + privileged: false + hostNetwork: false + hostIPC: false + hostPID: false + runAsUser: + # Permits the container to run with root privileges as well. + rule: 'RunAsAny' + seLinux: + # This policy assumes the nodes are using AppArmor rather than SELinux. + rule: 'RunAsAny' + supplementalGroups: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 0 + max: 65535 + fsGroup: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 0 + max: 65535 + readOnlyRootFilesystem: false + +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "s3gw.serviceAccountName" . }}-psp + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: "{{ replace "+" "_" .Chart.Version }}" + app.kubernetes.io/part-of: {{ include "s3gw.serviceAccountName" . }} + app: {{ include "s3gw.serviceAccountName" . }} +rules: +{{- if semverCompare "> 1.15.0-0" .Capabilities.KubeVersion.GitVersion }} +- apiGroups: ['policy'] +{{- else }} +- apiGroups: ['extensions'] +{{- end }} + resources: ['podsecuritypolicies'] + verbs: ['use'] + resourceNames: + - {{ include "s3gw.serviceAccountName" . }}-psp + +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "s3gw.serviceAccountName" . }}-psp + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: "{{ replace "+" "_" .Chart.Version }}" + app.kubernetes.io/part-of: {{ include "s3gw.serviceAccountName" . }} + app: {{ include "s3gw.serviceAccountName" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "s3gw.serviceAccountName" . }}-psp +subjects: + - kind: ServiceAccount + name: {{ include "s3gw.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} + +{{- end }} +{{- end }} +{{- end -}} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/secret.yaml b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/secret.yaml new file mode 100644 index 000000000..cdf13e1a7 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/secret.yaml @@ -0,0 +1,27 @@ +{{- if not .Values.useExistingSecret }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: '{{ .Values.defaultUserCredentialsSecret }}' + namespace: {{ .Release.Namespace }} + labels: +{{ include "s3gw.labels" . | indent 4 }} +type: Opaque +stringData: + RGW_DEFAULT_USER_ACCESS_KEY: {{ include "s3gw.defaultAccessKey" . | quote }} + RGW_DEFAULT_USER_SECRET_KEY: {{ include "s3gw.defaultSecretKey" . | quote }} +{{- end }} +{{- if .Values.imageCredentials }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: '{{ .Chart.Name }}-image-pull-secret' + namespace: {{ .Release.Namespace }} + labels: +{{ include "s3gw.labels" . | indent 4 }} +type: kubernetes.io/dockerconfigjson +data: + .dockerconfigjson: {{ template "s3gw.imagePullSecret" . }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/service.yaml b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/service.yaml new file mode 100644 index 000000000..d9e72ac82 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/service.yaml @@ -0,0 +1,38 @@ +--- +apiVersion: v1 +kind: Service +metadata: + name: '{{ .Values.serviceName }}' + namespace: {{ .Release.Namespace }} + labels: +{{ include "s3gw.labels" . | indent 4 }} +spec: + selector: +{{ include "s3gw.selectorLabels" . | indent 4 }} + ports: + - name: s3 + protocol: TCP + port: 80 + targetPort: s3 + - name: s3-tls + protocol: TCP + port: 443 + targetPort: s3-tls +{{- if .Values.ui.enabled }} +--- +apiVersion: v1 +kind: Service +metadata: + name: '{{ .Values.ui.serviceName }}' + namespace: {{ .Release.Namespace }} + labels: +{{ include "s3gw.labels" . | indent 4 }} +spec: + selector: +{{ include "s3gw-ui.selectorLabels" . | indent 4 }} + ports: + - name: webui + protocol: TCP + port: 80 + targetPort: 8080 +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/serviceaccount.yaml b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/serviceaccount.yaml new file mode 100644 index 000000000..7cf194a35 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/serviceaccount.yaml @@ -0,0 +1,13 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "s3gw.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "s3gw.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end -}} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/storage.yaml b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/storage.yaml new file mode 100644 index 000000000..36e87c721 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/storage.yaml @@ -0,0 +1,56 @@ +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: '{{ .Release.Name }}-pvc' + namespace: {{ .Release.Namespace }} + labels: +{{ include "s3gw.labels" . | indent 4 }} +spec: + storageClassName: {{ .Values.storageClass.name }} + accessModes: + - ReadWriteOnce + resources: + requests: + storage: {{ .Values.storageSize }} +{{- if (or .Values.storageClass.create .Values.storageClass.local) }} +--- +apiVersion: storage.k8s.io/v1 +kind: StorageClass +metadata: + name: {{ .Values.storageClass.name }} + namespace: {{ .Release.Namespace }} + labels: +{{ include "s3gw.labels" . | indent 4 }} +volumeBindingMode: Immediate +{{- if .Values.storageClass.local }} +provisioner: kubernetes.io/no-provisioner +{{- else }} +provisioner: driver.longhorn.io +allowVolumeExpansion: true +reclaimPolicy: Delete +parameters: + fsType: ext4 + numberOfReplicas: "1" + staleReplicaTimeout: "2880" + fromBackup: "" +{{- end }} +{{- if .Values.storageClass.local }} +--- +apiVersion: v1 +kind: PersistentVolume +metadata: + name: '{{ .Release.Name }}.{{ .Release.Namespace }}-local-pv' + labels: +{{ include "s3gw.labels" . | indent 4 }} + type: local +spec: + storageClassName: {{ .Values.storageClass.name }} + capacity: + storage: {{ .Values.storageSize }} + accessModes: + - ReadWriteOnce + hostPath: + path: {{ .Values.storageClass.localPath }} +{{- end }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/tests/smoke-bucket-create.yaml b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/tests/smoke-bucket-create.yaml new file mode 100644 index 000000000..e1aa7df92 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/tests/smoke-bucket-create.yaml @@ -0,0 +1,32 @@ +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: 'smoke-{{ .Chart.Name }}-bucket-create' + namespace: '{{ .Release.Namespace }}' + annotations: + helm.sh/hook: test +spec: + template: + spec: + containers: + - name: create-bucket + image: opensuse/tumbleweed:latest + command: + - /bin/sh + - -exc + - zypper -n install --no-recommends libs3-tools; + + s3 -u -t 50 create testbucket; + + s3 -u -t 50 list | grep testbucket + env: + - name: S3_ACCESS_KEY_ID + value: {{ .Values.accessKey | quote }} + - name: S3_SECRET_ACCESS_KEY + value: {{ .Values.secretKey | quote }} + - name: S3_HOSTNAME + value: + '{{ .Values.serviceName }}.{{ .Release.Namespace }}.{{ .Values.privateDomain }}' + restartPolicy: Never + backoffLimit: 3 diff --git a/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/tls-issuer.yaml b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/tls-issuer.yaml new file mode 100644 index 000000000..447159772 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/tls-issuer.yaml @@ -0,0 +1,46 @@ +{{- if .Values.useCertManager }} +--- +# Self-signed issuer +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: s3gw-self-signed-issuer + labels: +{{ include "s3gw.labels" . | indent 4}} +spec: + selfSigned: {} +--- +# Private s3gw-ca issuer +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: s3gw-issuer + labels: +{{ include "s3gw.labels" . | indent 4}} +spec: + ca: + secretName: s3gw-ca-root +--- +# Let's encrypt production issuer +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: s3gw-letsencrypt-issuer + labels: +{{ include "s3gw.labels" . | indent 4}} +spec: + acme: + email: {{ .Values.email }} + preferredChain: "" + privateKeySecretRef: + name: s3gw-letsencrypt + server: https://acme-v02.api.letsencrypt.org/directory + solvers: + - http01: + ingress: + ingressTemplate: + metadata: + annotations: + traefik.ingress.kubernetes.io/router.entrypoints: websecure + traefik.ingress.kubernetes.io/router.tls: "true" +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/tls-secret.yaml b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/tls-secret.yaml new file mode 100644 index 000000000..c5ab4f627 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/templates/tls-secret.yaml @@ -0,0 +1,46 @@ +{{- if not .Values.useCertManager }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: s3gw-ingress-tls + namespace: {{ .Release.Namespace }} + labels: +{{ include "s3gw.labels" . | indent 4 }} +type: kubernetes.io/tls +data: + tls.crt: | + {{ .Values.tls.publicDomain.crt }} + tls.key: | + {{ .Values.tls.publicDomain.key }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: s3gw-cluster-ip-tls + namespace: {{ .Release.Namespace }} + labels: +{{ include "s3gw.labels" . | indent 4 }} +type: kubernetes.io/tls +data: + tls.crt: | + {{ .Values.tls.privateDomain.crt }} + tls.key: | + {{ .Values.tls.privateDomain.key }} +{{- if .Values.ui.enabled }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: s3gw-ui-ingress-tls + namespace: {{ .Release.Namespace }} + labels: +{{ include "s3gw.labels" . | indent 4 }} +type: kubernetes.io/tls +data: + tls.crt: | + {{ .Values.tls.ui.publicDomain.crt }} + tls.key: | + {{ .Values.tls.ui.publicDomain.key }} +{{- end }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/charts/s3gw/values.yaml b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/values.yaml new file mode 100644 index 000000000..cdf89e746 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/charts/s3gw/values.yaml @@ -0,0 +1,112 @@ +--- + +serviceAccount: + # Specifies whether a service account should be created + create: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the s3gw.fullname template + name: "" + +# Ingress configuration. +ingress: + # 'enabled' will deploy an ingress resource to the cluster if set to `true`. + enabled: true + +# Use cert-manager +useCertManager: true +# cert-manager namespace +certManagerNamespace: cert-manager +# The name of the predefined TLS issuer to use (s3gw-issuer, s3gw-letsencrypt-issuer). +tlsIssuer: "s3gw-issuer" +# The email address you are planning to use for getting notifications +# about your certificates. Fill this if you are using the 's3gw-letsencrypt-issuer'. +email: "epinio@suse.com" + +# When not using cert-manager you have to manually specify +# TLS certificate/key pairs for all the services. +# Specify values in Base64 encoded in one line. +tls: + publicDomain: + crt: "" + key: "" + privateDomain: + crt: "" + key: "" + ui: + publicDomain: + crt: "" + key: "" + +# S3 user interface +# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! +# Note, the UI will not be able to access the RGW AdminOps API when +# using HTTPS and self-signed certificates because of CORS issues. +# To workaround that, please open the URL https:// in the +# browser and accept the SSL certificate before accessing the UI +# via https://. +# Check https://github.com/aquarist-labs/s3gw/issues/31 to get more +# information about the CORS issues. +# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! +ui: + # 'enabled' will deploy the S3GW user interface if set to `true`. + enabled: true + # 'serviceName' is the service name of the S3GW user interface. + serviceName: "s3gw-ui" + # 'publicDomain' is the public domain of the UI Service used by the Ingress. + publicDomain: "fe.127.0.0.1.omg.howdoi.website" + + # --- Developer Options --- + # imageName: "aquarist-labs/s3gw-ui" + # imageTag: "v0.0.0" + +# S3 Service +# +# 'serviceName' is the service name of S3GW. +serviceName: "s3gw" +# 'useExistingSecret' use an existing secret containing the S3 credentials +# for the default user +useExistingSecret: false +# 'defaultUserCredentialsSecret' the name of the secret containing +# the S3 Access Key and the S3 Secret Key for the default user. +defaultUserCredentialsSecret: "s3gw-creds" +# 'accessKey' is the S3 Access Key; the value is used when useExistingSecret: false. +# Set this as the empty string to make the Chart to compute a random alphanumeric value. +accessKey: "test" +# 'secretKey' is the S3 Secret Key; the value is used when useExistingSecret: false +# Set this as the empty string to make the Chart to compute a random alphanumeric value. +secretKey: "test" +# 'publicDomain' is the public domain of S3GW used by the Ingress +publicDomain: "be.127.0.0.1.omg.howdoi.website" +# 'privateDomain' is the private domain of S3GW used inside the Kubernetes cluster +privateDomain: "svc.cluster.local" + +# Backing storage. +# Name the storage class to use. If create is true, an opinionated storage class +# will be created. This assumes the Longhorn storage driver is installed. +storageSize: 10Gi +storageClass: + name: "longhorn-single" + create: true +# For testing only: +# local: false +# localPath: /var/lib/local-storage + +# --- Developer Options --- +# +# Image settings: +# imagePullPolicy: "Always" +# image.registry: "" +image: + repository: "rancher/mirrored-s3gw-s3gw" + tag: "v0.14.0" +# imageCredentials: +# username: foo +# password: bar +# email: foobar@suse.com + +# s3gw pod log level. +# Valid values are positive integers starting from 0. +# Higher values are more verbose. +logLevel: "1" diff --git a/charts/epinio/102.0.4+up1.9.0/questions.yml b/charts/epinio/102.0.4+up1.9.0/questions.yml new file mode 100644 index 000000000..faf15396d --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/questions.yml @@ -0,0 +1,186 @@ +questions: +- variable: global.rbac.pspEnabled + default: "false" + description: "Flag to enable or disable the installation of PodSecurityPolicies by this chart in the target cluster. If the cluster is running Kubernetes 1.25+, you must update this value to false." + label: "Enable PodSecurityPolicies" + type: boolean + group: "Security Settings" +- variable: global.tlsIssuerEmail + label: Issuer Email Receiver + description: "Email address to receive the certificate notification emails send by the `letsencrypt-production` issuer" + type: string + required: false + group: "General settings" +- variable: certManagerNamespace + label: Cert-manager namespace + description: "Namespace where cert-manager is installed in" + type: string + required: false + group: "Advanced settings" +- variable: ingress.ingressClassName + label: Ingress class name for the server + description: "Set a class name to select the ingress controller you want to use for the server" + type: string + group: "Advanced settings" +- variable: server.ingressClassName + label: Ingress class name for apps + description: "Set a class name to select the ingress controller you want to use for your apps" + type: string + group: "Advanced settings" +- variable: server.disableTracking + label: Disable tracking + description: "Disable tracking of the running Epinio and Kubernetes versions" + type: boolean + group: "Advanced settings" +- variable: serviceCatalog.enableDevServices + label: Enable catalog services for development + default: "true" + description: "Enables services in the Epinio service catalog, meant to be used in development (because they are running in-cluster)" + type: boolean + group: "Advanced settings" +- variable: useCustomTlsIssuer + label: Use your own TLS issuer + default: "false" + description: "Use your own TLS issuer" + type: boolean + group: "General settings" + show_subquestion_if: true + subquestions: + - variable: customTlsIssuer + label: TLS issuer + description: "Name of the cluster issuer to use" + type: string + required: false +- variable: global.tlsIssuer + show_if: "useCustomTlsIssuer=false" + label: TLS issuer + description: "Name of the predefined cluster issuer to use" + type: enum + required: false + group: "General settings" + options: + - "epinio-ca" + - "selfsigned-issuer" + - "letsencrypt-production" +- variable: api.username + label: API username + description: "The user name for authenticating all API requests" + type: string + required: false + group: "General settings" +- variable: api.passwordBcrypt + label: API password + description: "The password for authenticating all API requests (hashed with Bcrypt)" + type: password + required: false + group: "General settings" +- variable: global.domain + label: Domain + description: "Domain for the application" + type: string + required: true + group: "General settings" +- variable: server.accessControlAllowOrigin + label: Access control allow origin + description: "Domain which serves the Rancher UI (to access the API)" + type: string + required: false + group: "General settings" +- variable: kubed.enabled + label: Install kubed + description: "Deploy kubed or skip it if you get it installed already" + type: boolean + group: "Advanced settings" +- variable: containerregistry.enabled + description: "Disable local container registry to configure an external registry." + label: Install local container registry + type: boolean + show_subquestion_if: false + group: "External registry" + subquestions: + - variable: global.registryURL + label: External registry url + description: "URL of your external registry" + type: string + required: false + - variable: global.registryUsername + label: External registry username + description: "Username to authenticate to the external registry" + type: string + required: false + - variable: global.registryPassword + label: External registry password + description: "Password to authenticate to the external registry" + type: password + required: false + - variable: global.registryNamespace + label: External registry namespace + description: "The organization part of the registry path for an external registry where you have push access" + type: string + required: false + - variable: containerregistry.certificateSecret + label: External registry certificate secret + description: | + Name of Secret in Epinio's main namespace with PEM formatted certificate found at key 'tls.crt'. + Necessary for validating external registry used by Epinio's staging jobs. + Must be also trusted by kubelet in the cluster. + type: string + required: false +- variable: minio.enabled + label: Install Minio + description: "Disable Minio to either use s3gw or to configure an external s3 storage." + type: boolean + group: "S3 storage" + show_subquestion_if: false + subquestions: + - variable: s3gw.enabled + label: Install s3gw + description: "Disable s3gw to configure an external s3 storage." + type: boolean + show_subquestion_if: false + group: "S3 storage" + subquestions: + - variable: s3.endpoint + label: S3 endpoint + description: "Endpoint of your S3 storage" + type: string + required: false + - variable: s3.accessKeyID + label: S3 access key id + description: "Access key id to authenticate to your S3 storage" + type: string + required: false + - variable: s3.secretAccessKey + label: S3 access key secret + description: "Secret access key to authenticate to your S3 storage" + type: password + required: false + - variable: s3.bucket + label: S3 bucket + description: "Bucket of your S3 storage" + type: string + required: false + - variable: s3.region + label: S3 region + description: "Region of your S3 storage" + type: string + required: false + - variable: s3.useSSL + label: S3 use SSL + type: boolean + required: false + - variable: s3.certificateSecret + label: Self signed certificate for S3 + description: Set it to an existing secret if s3 is using a self signed certificate + type: string + required: false +- variable: server.traceLevel + label: Epinio API Log Level + required: false + type: string + group: "Debugging" +- variable: server.timeoutMultiplier + label: Timeout Multiplier + required: false + type: string + group: "Debugging" diff --git a/charts/epinio/102.0.4+up1.9.0/templates/NOTES.txt b/charts/epinio/102.0.4+up1.9.0/templates/NOTES.txt new file mode 100644 index 000000000..f0c1dd2ba --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/templates/NOTES.txt @@ -0,0 +1,12 @@ +To interact with your Epinio installation download the latest epinio binary from https://github.com/epinio/epinio/releases/latest. + +Login to the cluster with any of +{{ range .Values.api.users }} + `epinio login -u {{ .username }} https://epinio.{{ $.Values.global.domain }}` +{{- end }} + +or go to the dashboard at: https://epinio.{{ .Values.global.domain }} + +If you didn't specify a password the default one is `password`. + +For more information about Epinio, feel free to checkout https://epinio.io/ and https://docs.epinio.io/. diff --git a/charts/epinio/102.0.4+up1.9.0/templates/_helpers.tpl b/charts/epinio/102.0.4+up1.9.0/templates/_helpers.tpl new file mode 100644 index 000000000..7b9955b02 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/templates/_helpers.tpl @@ -0,0 +1,196 @@ +{{/* +URL prefix for container images to be compatible with Rancher +*/}} +{{- define "registry-url" -}} +{{- if .Values.global.cattle.systemDefaultRegistry -}} +{{ trimSuffix "/" .Values.global.cattle.systemDefaultRegistry }}/ +{{- end -}} +{{- end -}} + +{{/* +URL of the registry epinio uses to store workload images +*/}} +{{- define "epinio.registry-url" -}} +{{- if .Values.containerregistry.enabled -}} +{{- printf "registry.%s.svc.cluster.local:5000" .Release.Namespace }} +{{- else -}} +{{- .Values.global.registryURL }} +{{- end -}} +{{- end -}} + +{{/* +URL of the minio epinio installed +*/}} +{{- define "epinio.minio-url" -}} +{{- if .Values.minio.enabled -}} +{{- printf "%s.%s.svc.cluster.local:9000" .Values.minio.fullnameOverride .Release.Namespace }} +{{- else -}} +{{- .Values.s3.endpoint }} +{{- end -}} +{{- end -}} + +{{/* +Host name of the minio epinio installed +*/}} +{{- define "epinio.minio-hostname" -}} +{{- printf "%s.%s.svc.cluster.local" .Values.minio.fullnameOverride .Release.Namespace }} +{{- end -}} + +{{/* +URL of the s3gw epinio installed +*/}} +{{- define "epinio.s3gw-url" -}} +{{- if .Values.s3gw.enabled -}} +{{- printf "%s.%s.svc.cluster.local" .Values.s3gw.serviceName .Release.Namespace }} +{{- else -}} +{{- .Values.s3.endpoint }} +{{- end -}} +{{- end -}} + +{{/* +Host name of the s3gw epinio installed +*/}} +{{- define "epinio.s3gw-hostname" -}} +{{- printf "%s.%s.svc.cluster.local" .Values.s3gw.serviceName .Release.Namespace }} +{{- end -}} + +{{/* +PVC cleanup hooks for bitnami helm chart based catalog services +# https://github.com/epinio/epinio/issues/1386 +# https://docs.bitnami.com/kubernetes/apps/aspnet-core/administration/deploy-extra-resources/ +*/}} +{{- define "epinio.catalog-service-values" -}} +{{ printf ` +extraDeploy: + - | + # Create a service account, role and binding to allow to list, get and + # delete PVCs. It should be used by the job below. + + # To ensure the resources are deleted, use this annotation: + # + # annotations: + # "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded + + # https://helm.sh/docs/topics/charts_hooks/#hook-resources-are-not-managed-with-corresponding-releases + # https://helm.sh/docs/topics/charts_hooks/#hook-deletion-policies + + --- + apiVersion: v1 + kind: ServiceAccount + metadata: + name: "pvc-deleter-{{ .Release.Name }}" + namespace: {{ .Release.Namespace }} + annotations: + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded + "helm.sh/hook": post-delete + "helm.sh/hook-weight": "-6" + + --- + apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} + kind: Role + metadata: + name: "pvc-deleter-{{ .Release.Name }}" + namespace: {{ .Release.Namespace }} + annotations: + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded + "helm.sh/hook": post-delete + "helm.sh/hook-weight": "-6" + rules: + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - delete + - list + + --- + kind: RoleBinding + apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} + metadata: + name: "pvc-deleter-{{ .Release.Name }}" + namespace: {{ .Release.Namespace }} + annotations: + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded + "helm.sh/hook": post-delete + "helm.sh/hook-weight": "-5" + subjects: + - kind: ServiceAccount + name: "pvc-deleter-{{ .Release.Name }}" + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: "pvc-deleter-{{ .Release.Name }}" + + --- + apiVersion: batch/v1 + kind: Job + metadata: + name: "pvc-deleter-{{ .Release.Name }}" + labels: + app.kubernetes.io/managed-by: {{ .Release.Service | quote }} + app.kubernetes.io/instance: {{ .Release.Name | quote }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + annotations: + # This is what defines this resource as a hook. Without this line, the + # job is considered part of the release. + "helm.sh/hook": post-delete + "helm.sh/hook-weight": "-4" + "helm.sh/hook-delete-policy": hook-succeeded + spec: + template: + metadata: + name: "pvc-deleter-{{ .Release.Name }}" + labels: + app.kubernetes.io/managed-by: {{ .Release.Service | quote }} + app.kubernetes.io/instance: {{ .Release.Name | quote }} + helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + spec: + restartPolicy: Never + serviceAccountName: "pvc-deleter-{{ .Release.Name }}" + containers: + - name: post-install-job + image: "%s" + command: ["kubectl", "delete", "pvc", "-n", "{{ .Release.Namespace }}", "-l", "app.kubernetes.io/instance={{ .Release.Name }}"] +` (print (include "registry-url" .) .Values.image.kubectl.repository ":" .Values.image.kubectl.tag) | indent 4}} +{{- end -}} + +{{/* +Removes characters that are invalid for kubernetes resource names from the +given string +*/}} +{{- define "epinio-name-sanitize" -}} +{{ regexReplaceAll "[^-a-z0-9]*" . "" }} +{{- end }} + +{{/* +Resource name sanitization and truncation. +- Always suffix the sha1sum (40 characters long) +- Always add an "r" prefix to make sure we don't have leading digits +- The rest of the characters up to 63 are the original string with invalid +character removed. +*/}} +{{- define "epinio-truncate" -}} +{{ print "r" (trunc 21 (include "epinio-name-sanitize" .)) "-" (sha1sum .) }} +{{- end }} + +{{/* +Windows cluster will add default taint for linux nodes, add below linux tolerations to +workloads could be scheduled to those linux nodes +*/}} +{{- define "linux-node-tolerations" -}} +- key: "cattle.io/os" + value: "linux" + effect: "NoSchedule" + operator: "Equal" +{{- end -}} + +{{- define "linux-node-selector" -}} +{{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}} +beta.kubernetes.io/os: linux +{{- else -}} +kubernetes.io/os: linux +{{- end -}} +{{- end -}} diff --git a/charts/epinio/102.0.4+up1.9.0/templates/assets.yaml b/charts/epinio/102.0.4+up1.9.0/templates/assets.yaml new file mode 100644 index 000000000..3614c7a96 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/templates/assets.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Secret +metadata: + namespace: {{ .Release.Namespace }} + name: epinio-assets + labels: + app.kubernetes.io/component: epinio + app.kubernetes.io/name: epinio-assets + app.kubernetes.io/part-of: epinio + app.kubernetes.io/version: {{ .Chart.AppVersion }} +type: Opaque +data: +{{ (.Files.Glob "assets/*").AsSecrets | indent 2 }} diff --git a/charts/epinio/102.0.4+up1.9.0/templates/certificate.yaml b/charts/epinio/102.0.4+up1.9.0/templates/certificate.yaml new file mode 100644 index 000000000..025641533 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/templates/certificate.yaml @@ -0,0 +1,50 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: epinio + namespace: {{ .Release.Namespace }} +spec: + dnsNames: + - epinio.{{ .Values.global.domain }} + issuerRef: + kind: ClusterIssuer + name: {{ default .Values.global.tlsIssuer .Values.global.customTlsIssuer | quote }} + secretName: epinio-tls + +{{- if .Values.minio.enabled }} +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: minio-cert + namespace: {{ .Release.Namespace }} +spec: + dnsNames: + - {{ include "epinio.minio-hostname" . }} + issuerRef: + kind: ClusterIssuer + # We always trust the CA for minio so we can always use selfsigned certs + # Because Letsencrypt doesn't create certs for non public domains + name: epinio-ca + secretName: minio-tls + secretTemplate: + annotations: + kubed.appscode.com/sync: "kubed-s3-tls-from={{ .Release.Namespace }}" +{{- end }} + +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: epinio-ca + namespace: {{ .Values.certManagerNamespace }} +spec: + commonName: epinio-ca + isCA: true + issuerRef: + kind: ClusterIssuer + name: selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 + secretName: epinio-ca-root diff --git a/charts/epinio/102.0.4+up1.9.0/templates/chart-validations.yaml b/charts/epinio/102.0.4+up1.9.0/templates/chart-validations.yaml new file mode 100644 index 000000000..e9dd50869 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/templates/chart-validations.yaml @@ -0,0 +1,6 @@ +{{- if (and .Values.minio.enabled .Values.s3gw.enabled) }} +{{- fail "use either minio or s3gw" }} +{{- end }} +{{- if (empty .Values.global.domain) }} +{{- fail "domain cannot be empty" }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/templates/cluster-issuers.yaml b/charts/epinio/102.0.4+up1.9.0/templates/cluster-issuers.yaml new file mode 100644 index 000000000..c9d38a9f4 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/templates/cluster-issuers.yaml @@ -0,0 +1,44 @@ +--- +# Self-signed issuer +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: selfsigned-issuer +spec: + selfSigned: {} + +--- +# Let's encrypt production issuer +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-production +spec: + acme: + email: {{ .Values.global.tlsIssuerEmail | default .Values.email | quote }} + preferredChain: "" + privateKeySecretRef: + name: letsencrypt-production + server: https://acme-v02.api.letsencrypt.org/directory + solvers: + - http01: + ingress: + {{- if .Values.ingress.ingressClassName }} + class: "{{ .Values.ingress.ingressClassName }}" + {{- end }} + ingressTemplate: + metadata: + annotations: + traefik.ingress.kubernetes.io/router.entrypoints: websecure + traefik.ingress.kubernetes.io/router.tls: "true" + +--- +# Private CA (epinio-ca) issuer +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: epinio-ca +spec: + ca: + secretName: epinio-ca-root + diff --git a/charts/epinio/102.0.4+up1.9.0/templates/container-registry.yaml b/charts/epinio/102.0.4+up1.9.0/templates/container-registry.yaml new file mode 100644 index 000000000..d6d23d352 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/templates/container-registry.yaml @@ -0,0 +1,193 @@ +{{- if .Values.containerregistry.enabled }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: auth + namespace: {{ .Release.Namespace }} +stringData: + # The only supported password format is bcrypt + htpasswd: {{ htpasswd .Values.global.registryUsername .Values.global.registryPassword | quote }} + +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: epinio-registry + namespace: {{ .Release.Namespace }} +spec: + dnsNames: + - registry.{{ .Release.Namespace }}.svc.cluster.local + ipAddresses: + - 127.0.0.1 + issuerRef: + kind: ClusterIssuer + name: epinio-ca + secretName: epinio-registry-tls + +--- +apiVersion: v1 +kind: Service +metadata: + name: registry + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: "epinio-registry" + app.kubernetes.io/instance: "epinio-registry" +spec: + type: ClusterIP + selector: + app.kubernetes.io/name: "epinio-registry" + app.kubernetes.io/instance: "epinio-registry" + ports: + - name: registry + port: 5000 + targetPort: 5000 + +{{ if .Values.containerregistry.enabled }} +--- +apiVersion: v1 +kind: Service +metadata: + name: registry-node + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: "epinio-registry" + app.kubernetes.io/instance: "epinio-registry" +spec: + type: NodePort + selector: + app.kubernetes.io/name: "epinio-registry" + app.kubernetes.io/instance: "epinio-registry" + ports: + - name: registry-sidecar + port: 30500 + targetPort: 30500 + nodePort: 30500 +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: nginx-conf + namespace: {{ .Release.Namespace }} +data: + nginx.conf: | + server { + listen 30500 default_server; + server_name 127.0.0.1; + + location / { + proxy_pass https://localhost:5000/; + } + } +{{- end }} + +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: registry + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: "epinio-registry" + app.kubernetes.io/instance: "epinio-registry" +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: "epinio-registry" + app.kubernetes.io/instance: "epinio-registry" + template: + metadata: + labels: + app.kubernetes.io/name: "epinio-registry" + app.kubernetes.io/instance: "epinio-registry" + spec: + containers: +{{ if .Values.containerregistry.enabled }} + - name: nginx + image: "{{ template "registry-url" . }}{{ .Values.containerregistry.image.nginx.repository}}:{{ .Values.containerregistry.image.nginx.tag }}" + imagePullPolicy: IfNotPresent + securityContext: + runAsUser: 1000 + runAsNonRoot: true + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + livenessProbe: + tcpSocket: + port: 5000 + initialDelaySeconds: 15 + periodSeconds: 20 + readinessProbe: + tcpSocket: + port: 5000 + volumeMounts: + - mountPath: /etc/nginx/conf.d + name: nginx-conf + - mountPath: /var/cache/nginx/ + name: nginx-run + - mountPath: /var/run/ + name: nginx-run +{{- end }} + - name: registry + image: "{{ template "registry-url" . }}{{ .Values.containerregistry.image.registry.repository}}:{{ .Values.containerregistry.image.registry.tag }}" + imagePullPolicy: {{ .Values.containerregistry.imagePullPolicy }} + env: + - name: REGISTRY_AUTH + value: htpasswd + - name: REGISTRY_AUTH_HTPASSWD_REALM + value: Registry Realm + - name: REGISTRY_AUTH_HTPASSWD_PATH + value: /etc/registry/auth/htpasswd + - name: REGISTRY_HTTP_TLS_CERTIFICATE + value: "/certs/tls.crt" + - name: REGISTRY_HTTP_TLS_KEY + value: "/certs/tls.key" + - name: REGISTRY_STORAGE_DELETE_ENABLED + value: "true" + volumeMounts: + - name: registry + mountPath: /var/lib/registry + readOnly: false + - name: auth + mountPath: /etc/registry/auth + readOnly: true + - name: certs + mountPath: /certs + readOnly: true + securityContext: + runAsUser: 1000 + runAsNonRoot: true + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + livenessProbe: + httpGet: + port: 5000 + scheme: HTTPS + initialDelaySeconds: 15 + periodSeconds: 20 + readinessProbe: + httpGet: + port: 5000 + scheme: HTTPS + initialDelaySeconds: 5 + periodSeconds: 5 + volumes: + - name: registry + emptyDir: {} + - name: auth + secret: + secretName: auth + - name: certs + secret: + secretName: epinio-registry-tls +{{ if .Values.containerregistry.enabled }} + - name: nginx-conf + configMap: + name: nginx-conf + - name: nginx-cache + emptyDir: {} + - name: nginx-run + emptyDir: {} +{{- end }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/templates/default-app-chart.yaml b/charts/epinio/102.0.4+up1.9.0/templates/default-app-chart.yaml new file mode 100644 index 000000000..79ade1aed --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/templates/default-app-chart.yaml @@ -0,0 +1,19 @@ +apiVersion: application.epinio.io/v1 +kind: AppChart +metadata: + namespace: {{ .Release.Namespace }} + name: standard + labels: + app.kubernetes.io/component: epinio + app.kubernetes.io/instance: default + app.kubernetes.io/name: epinio-standard-app-chart + app.kubernetes.io/part-of: epinio + app.kubernetes.io/version: {{ default .Chart.AppVersion .Values.image.epinio.tag }} +spec: + shortDescription: Epinio standard deployment + description: Epinio standard support chart for application deployment + helmChart: {{ .Values.appChart.default | quote }} + settings: + appListeningPort: + type: 'integer' + minimum: '0' diff --git a/charts/epinio/102.0.4+up1.9.0/templates/default-user.yaml b/charts/epinio/102.0.4+up1.9.0/templates/default-user.yaml new file mode 100644 index 000000000..0929de38a --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/templates/default-user.yaml @@ -0,0 +1,17 @@ +{{- range .Values.api.users }} +--- +apiVersion: v1 +kind: Secret +type: BasicAuth +metadata: + labels: + epinio.io/api-user-credentials: "true" + epinio.io/role: {{ .role }} + name: {{ include "epinio-truncate" (print "user-" .username) }} + namespace: {{ $.Release.Namespace }} +stringData: + username: {{ .username | quote }} + password: {{ .passwordBcrypt | quote }} + namespaces: | + {{ join "\n" .workspaces -}} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/templates/dex.yaml b/charts/epinio/102.0.4+up1.9.0/templates/dex.yaml new file mode 100644 index 000000000..19bfe5c39 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/templates/dex.yaml @@ -0,0 +1,103 @@ +{{- if .Values.global.dex.enabled -}} + +{{- $dexSecret := (lookup "v1" "Secret" .Release.Namespace "dex-config").data | default dict -}} +{{- $prevUiClientSecret := (get $dexSecret "uiClientSecret") -}} +{{- $uiClientSecret := empty $prevUiClientSecret | ternary (randAlphaNum 32) (b64dec $prevUiClientSecret) -}} + +--- +apiVersion: v1 +kind: Secret +type: Opaque +metadata: + annotations: + name: dex-config + namespace: {{ .Release.Namespace }} +stringData: + issuer: "https://auth.{{ .Values.global.domain }}" + endpoint: {{ printf "http://%s.%s.svc.cluster.local:5556" .Values.dex.fullnameOverride .Release.Namespace }} + uiClientSecret: {{ $uiClientSecret }} + config.yaml: |- + issuer: "https://auth.{{ .Values.global.domain }}" + storage: + type: kubernetes + config: + inCluster: true + enablePasswordDB: true + staticPasswords: + - email: "admin@epinio.io" + # bcrypt hash of the string "password": $(echo password | htpasswd -BinC 10 admin | cut -d: -f2) + hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W" + username: "admin" + userID: "08a8684b-db88-4b73-90a9-3cd1661f5466" + - email: "epinio@epinio.io" + hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W" + userID: "08a8684b-db88-4b73-90a9-3cd1661f5467" + + staticClients: + - id: epinio-api + name: 'Epinio API' + public: true + # The 'Epinio API' lets the 'Epinio cli' issue ID tokens on its behalf. + # https://dexidp.io/docs/custom-scopes-claims-clients/#cross-client-trust-and-authorized-party + trustedPeers: + - epinio-cli + - epinio-ui + + - id: epinio-cli + name: 'Epinio cli' + public: true + + - id: epinio-ui + name: 'Epinio UI' + secret: {{ $uiClientSecret | quote }} + # Shouldn't be public, https://dexidp.io/docs/custom-scopes-claims-clients/#public-clients + redirectURIs: + - {{ .Values.dex.ui.redirectURI | default (printf "https://epinio.%s/auth/verify/" .Values.global.domain) | quote }} + +--- +apiVersion: v1 +kind: Secret +type: Opaque +metadata: + labels: + epinio.io/api-user-credentials: "true" + epinio.io/role: "admin" + name: {{ include "epinio-truncate" (print "user-" "admin@epinio.io") }} + namespace: {{ .Release.Namespace }} +stringData: + username: "admin@epinio.io" + +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: dex + namespace: {{ .Release.Namespace }} + annotations: + cert-manager.io/cluster-issuer: {{ default .Values.global.tlsIssuer .Values.global.customTlsIssuer | quote }} + traefik.ingress.kubernetes.io/router.entrypoints: websecure + traefik.ingress.kubernetes.io/router.tls: "true" + {{- range $key, $value := .Values.ingress.annotations }} + {{ $key | quote }}: {{ $value | quote }} + {{- end }} +spec: + {{- if .Values.ingress.ingressClassName }} + ingressClassName: "{{ .Values.ingress.ingressClassName }}" + {{- end }} + rules: + - host: "auth.{{ .Values.global.domain }}" + http: + paths: + - backend: + service: + name: dex + port: + number: 5556 + path: / + pathType: Prefix + tls: + - hosts: + - "auth.{{ .Values.global.domain }}" + secretName: dex-tls + +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/templates/ingress.yaml b/charts/epinio/102.0.4+up1.9.0/templates/ingress.yaml new file mode 100644 index 000000000..ae08585c4 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/templates/ingress.yaml @@ -0,0 +1,58 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + annotations: + traefik.ingress.kubernetes.io/router.entrypoints: websecure + traefik.ingress.kubernetes.io/router.tls: "true" + nginx.ingress.kubernetes.io/ssl-redirect: {{ .Values.ingress.nginxSSLRedirect | quote }} + nginx.ingress.kubernetes.io/proxy-body-size: 100m + nginx.org/websocket-service: "epinio-server" + {{- range $key, $value := .Values.ingress.annotations }} + {{ $key | quote }}: {{ $value | quote }} + {{- end }} + labels: + app.kubernetes.io/name: epinio + name: epinio + namespace: {{ .Release.Namespace }} +spec: + {{- if .Values.ingress.ingressClassName }} + ingressClassName: "{{ .Values.ingress.ingressClassName }}" + {{- end }} + rules: + - host: "epinio.{{ .Values.global.domain }}" + http: + paths: + - backend: + service: + name: epinio-server + port: + number: 80 + path: /api + pathType: Prefix + - backend: + service: + name: epinio-server + port: + number: 80 + path: /wapi + pathType: Prefix + - backend: + service: + name: epinio-server + port: + number: 80 + path: /ready + pathType: Exact + {{- if ".Values.epinio-ui.enabled" }} + - backend: + service: + name: epinio-ui + port: + number: 80 + path: / + pathType: Prefix + {{- end }} + tls: + - hosts: + - "epinio.{{ .Values.global.domain }}" + secretName: epinio-tls diff --git a/charts/epinio/102.0.4+up1.9.0/templates/psp.yaml b/charts/epinio/102.0.4+up1.9.0/templates/psp.yaml new file mode 100644 index 000000000..f4097a113 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/templates/psp.yaml @@ -0,0 +1,83 @@ +{{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy" -}} +{{- if .Values.global.rbac.pspEnabled }} + +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: epinio-server-psp + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: "{{ replace "+" "_" .Chart.Version }}" + app.kubernetes.io/part-of: epinio-server + app: epinio-server +{{- if .Values.global.rbac.pspAnnotations }} + annotations: {{ toYaml .Values.global.rbac.pspAnnotations | nindent 4 }} +{{- end }} +spec: + privileged: false + hostNetwork: false + hostIPC: false + hostPID: false + runAsUser: + # Permits the container to run with root privileges as well. + rule: 'RunAsAny' + seLinux: + # This policy assumes the nodes are using AppArmor rather than SELinux. + rule: 'RunAsAny' + supplementalGroups: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 0 + max: 65535 + fsGroup: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 0 + max: 65535 + readOnlyRootFilesystem: false + +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: epinio-server-psp + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: "{{ replace "+" "_" .Chart.Version }}" + app.kubernetes.io/part-of: epinio-server + app: epinio-server +rules: +{{- if semverCompare "> 1.15.0-0" .Capabilities.KubeVersion.GitVersion }} +- apiGroups: ['policy'] +{{- else }} +- apiGroups: ['extensions'] +{{- end }} + resources: ['podsecuritypolicies'] + verbs: ['use'] + resourceNames: + - epinio-server-psp + +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: epinio-server-psp + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: "{{ replace "+" "_" .Chart.Version }}" + app.kubernetes.io/part-of: epinio-server + app: epinio-server +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: epinio-server-psp +subjects: + - kind: ServiceAccount + name: epinio-server + namespace: {{ .Release.Namespace }} + +{{- end }} +{{- end -}} diff --git a/charts/epinio/102.0.4+up1.9.0/templates/registry-secret.yaml b/charts/epinio/102.0.4+up1.9.0/templates/registry-secret.yaml new file mode 100644 index 000000000..6539d3503 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/templates/registry-secret.yaml @@ -0,0 +1,27 @@ +--- +apiVersion: v1 +kind: Secret +type: kubernetes.io/dockerconfigjson +metadata: + annotations: + epinio.io/registry-namespace: {{ .Values.global.registryNamespace }} + kubed.appscode.com/sync: kubed-sync=registry-creds + name: registry-creds + namespace: {{ .Release.Namespace }} +stringData: + .dockerconfigjson: |- + { + "auths": { + "{{ template "epinio.registry-url" . }}": { + "auth":"{{ printf "%s:%s" .Values.global.registryUsername .Values.global.registryPassword | b64enc }}", + "username":"{{ .Values.global.registryUsername }}", + "password":"{{ .Values.global.registryPassword }}" + } {{- if .Values.containerregistry.enabled }} , + "127.0.0.1:30500": { + "auth":"{{ printf "%s:%s" .Values.global.registryUsername .Values.global.registryPassword | b64enc }}", + "username":"{{ .Values.global.registryUsername }}", + "password":"{{ .Values.global.registryPassword }}" + } + {{- end -}} + } + } diff --git a/charts/epinio/102.0.4+up1.9.0/templates/s3-secret.yaml b/charts/epinio/102.0.4+up1.9.0/templates/s3-secret.yaml new file mode 100644 index 000000000..f78776100 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/templates/s3-secret.yaml @@ -0,0 +1,80 @@ +# defaulting s3 config with the user provided values +{{- $s3Endpoint := .Values.s3.endpoint }} +{{- $s3AccessKey := .Values.s3.accessKeyID }} +{{- $s3SecretKey := .Values.s3.secretAccessKey }} +{{- $s3Bucket := .Values.s3.bucket }} +{{- $s3UseSSL := .Values.s3.useSSL }} +{{- $s3Region := .Values.s3.region }} +# minio values if minio is enabled +{{- if .Values.minio.enabled }} +# Generated credentials for minio. Used only if minio is enabled. +{{- $oldkeys := (lookup "v1" "Secret" .Release.Namespace "minio-creds").data -}} +{{- $accessKey := empty $oldkeys | ternary (randAlphaNum 16) (b64dec (default "" $oldkeys.accesskey)) -}} +{{- $secretKey := empty $oldkeys | ternary (randAlphaNum 16) (b64dec (default "" $oldkeys.secretkey)) -}} +{{- $s3Endpoint = include "epinio.minio-url" . -}} +{{- $s3AccessKey = $accessKey }} +{{- $s3SecretKey = $secretKey }} +{{- $s3UseSSL = true }} +# s3gw values if s3gw is enabled +{{- else if .Values.s3gw.enabled }} +# Generated credentials for s3gw. Used only if s3gw is enabled. +{{- $oldkeys := (lookup "v1" "Secret" .Release.Namespace .Values.s3gw.defaultUserCredentialsSecret).data -}} +{{- $accessKey := empty $oldkeys | ternary (randAlphaNum 32) (b64dec (default "" $oldkeys.RGW_DEFAULT_USER_ACCESS_KEY)) -}} +{{- $secretKey := empty $oldkeys | ternary (randAlphaNum 32) (b64dec (default "" $oldkeys.RGW_DEFAULT_USER_SECRET_KEY)) -}} +{{- $s3Endpoint = include "epinio.s3gw-url" . -}} +{{- $s3AccessKey = $accessKey }} +{{- $s3SecretKey = $secretKey }} +{{- $s3UseSSL = true }} +{{- end }} + +--- +# The S3 connection details as required by the staging Job (in "ini" format) +apiVersion: v1 +kind: Secret +type: Opaque +metadata: + name: epinio-s3-connection-details + namespace: {{ .Release.Namespace }} +stringData: + bucket: {{ $s3Bucket }} + config: |- + [default] + region={{ $s3Region }} + credentials: |- + [default] + aws_access_key_id={{ $s3AccessKey }} + aws_secret_access_key={{ $s3SecretKey }} + endpoint: {{ $s3Endpoint | quote }} + useSSL: {{ $s3UseSSL | quote }} + +# Secrets get created first so Minio and s3gw should find them there when they needs them. +# https://github.com/helm/helm/blob/release-3.0/pkg/releaseutil/kind_sorter.go + +{{- if .Values.minio.enabled }} +# The S3 connection details as required by Minio deployment +# https://github.com/minio/minio/blob/8ae46bce937567e682d14f7fe845b8ff67e549d2/helm/minio/values.yaml#L81 +--- +apiVersion: v1 +kind: Secret +type: Opaque +metadata: + name: minio-creds + namespace: {{ .Release.Namespace }} +stringData: + rootUser: {{ $s3AccessKey | quote }} + rootPassword: {{ $s3SecretKey | quote }} + accesskey: {{ $s3AccessKey | quote }} + secretkey: {{ $s3SecretKey | quote }} +{{- else if .Values.s3gw.enabled }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: '{{ .Values.s3gw.defaultUserCredentialsSecret }}' + namespace: {{ .Release.Namespace }} + labels: +type: Opaque +stringData: + RGW_DEFAULT_USER_ACCESS_KEY: {{ $s3AccessKey | quote }} + RGW_DEFAULT_USER_SECRET_KEY: {{ $s3SecretKey | quote }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/templates/server.yaml b/charts/epinio/102.0.4+up1.9.0/templates/server.yaml new file mode 100644 index 000000000..ee6ff8986 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/templates/server.yaml @@ -0,0 +1,418 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: epinio-server + namespace: {{ .Release.Namespace }} + +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: epinio-server-cluster-admin +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin +subjects: +- kind: ServiceAccount + name: epinio-server + namespace: {{ .Release.Namespace }} + +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: epinio-server +rules: +- apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - create + - delete + - list +- apiGroups: + - "" + resources: + - nodes + verbs: + - list +- apiGroups: + - "" + resources: + - services + verbs: + - create + - get + - update + - delete +- apiGroups: + - "" + resources: + - pods/exec + verbs: + - create + - get + - post +- apiGroups: + - "" + resources: + - pods/portforward + verbs: + - get +- apiGroups: + - "" + resources: + - pods/log + verbs: + - get + - list +- apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch +- apiGroups: + - networking.k8s.io + resources: + - ingresses + verbs: + - create + - update + - delete + - get + - list +- apiGroups: + - "" + resources: + - secrets + verbs: + - create + - delete + - get + - list + - patch + - update +- apiGroups: + - apps + resources: + - deployments + verbs: + - create + - delete + - get + - list + - update + - patch +- apiGroups: + - servicecatalog.k8s.io + resources: + - servicebindings + verbs: + - create + - get + - delete + - list +- apiGroups: + - servicecatalog.k8s.io + resources: + - serviceinstances + verbs: + - create + - delete + - get + - list +- apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - list + - create + - delete +- apiGroups: + - "" + resources: + - serviceaccounts + verbs: + - create + - delete +- apiGroups: + - "cert-manager.io" + resources: + - certificates + verbs: + - create +- apiGroups: + - application.epinio.io + resources: + - apps + verbs: + - get + - list + - create + - delete + - patch + - update +- apiGroups: + - "metrics.k8s.io" + resources: + - pods + verbs: + - list +- apiGroups: + - apps + resources: + - replicasets + verbs: + - list + +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: epinio-server-cluster-role +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: epinio-server +subjects: +- kind: ServiceAccount + name: epinio-server + namespace: {{ .Release.Namespace }} + +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: epinio-server + namespace: {{ .Release.Namespace }} +rules: +- apiGroups: + - batch + resources: + - jobs + verbs: + - get + - create + - delete + - list +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get + +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: epinio-server-role + namespace: {{ .Release.Namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: epinio-server +subjects: +- kind: ServiceAccount + name: epinio-server + namespace: {{ .Release.Namespace }} + +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/component: epinio + app.kubernetes.io/instance: default + app.kubernetes.io/name: epinio-server + app.kubernetes.io/part-of: epinio + app.kubernetes.io/version: {{ default .Chart.AppVersion .Values.image.epinio.tag }} + name: epinio-server + namespace: {{ .Release.Namespace }} +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/component: epinio-server + app.kubernetes.io/instance: default + app.kubernetes.io/name: epinio-server + app.kubernetes.io/part-of: epinio + {{- with .Values.strategy }} + strategy: + {{- toYaml . | nindent 4 }} + {{- end }} + template: + metadata: + labels: + app.kubernetes.io/component: epinio-server + app.kubernetes.io/instance: default + app.kubernetes.io/name: epinio-server + app.kubernetes.io/part-of: epinio + app.kubernetes.io/version: {{ default .Chart.AppVersion .Values.image.epinio.tag }} + name: epinio-server + spec: + tolerations: + {{- include "linux-node-tolerations" . | nindent 8 }} + nodeSelector: + {{- include "linux-node-selector" . | nindent 8 }} + serviceAccountName: epinio-server + volumes: + - name: asset-volume + secret: + secretName: epinio-assets + - name: tmp-volume + emptyDir: {} + - name: image-export-volume + persistentVolumeClaim: + claimName: image-export-pvc +{{- if .Values.global.dex.enabled }} + - name: dex-tls + secret: + secretName: dex-tls + optional: false +{{- end }} + containers: + - command: ["/epinio", "server"] + args: ["--port", "8030"] + env: + - name: EPINIO_SETTINGS + value: /tmp/settings.yaml + - name: NAMESPACE + value: "{{ .Release.Namespace }}" + - name: ACCESS_CONTROL_ALLOW_ORIGIN + value: "{{ .Values.server.accessControlAllowOrigin }}" + - name: EPINIO_TIMEOUT_MULTIPLIER + value: "{{ .Values.server.timeoutMultiplier }}" + - name: TLS_ISSUER + value: "{{ .Values.global.tlsIssuer }}" + - name: TRACE_LEVEL + value: "{{ .Values.server.traceLevel }}" + - name: CHART_VERSION + value: "{{ .Chart.Version }}" + {{- $imageSkopeo := .Values.image.skopeo -}} + {{- if $imageSkopeo }} + - name: APP_IMAGE_EXPORTER + value: "{{ default $imageSkopeo.registry (include "registry-url" .) }}{{ $imageSkopeo.repository}}:{{ $imageSkopeo.tag }}" + {{- end }} + {{- if .Values.server.disableTracking }} + - name: DISABLE_TRACKING + value: "true" + {{- end }} + {{- if .Values.minio.enabled }} + - name: S3_CERTIFICATE_SECRET + value: {{ default "minio-tls" .Values.s3.certificateSecret }} + {{- else if .Values.s3gw.enabled }} + - name: S3_CERTIFICATE_SECRET + value: {{ default "s3gw-cluster-ip-tls" .Values.s3.certificateSecret }} + {{- else if .Values.s3.certificateSecret }} + - name: S3_CERTIFICATE_SECRET + value: {{ .Values.s3.certificateSecret }} + {{- end }} + {{- if .Values.containerregistry.enabled }} + - name: REGISTRY_CERTIFICATE_SECRET + value: "epinio-registry-tls" + {{- else if .Values.containerregistry.certificateSecret }} + - name: REGISTRY_CERTIFICATE_SECRET + value: {{ .Values.containerregistry.certificateSecret }} + {{- end }} + {{- if .Values.server.ingressClassName }} + - name: INGRESS_CLASS_NAME + value: "{{ .Values.server.ingressClassName }}" + {{- else if .Values.ingress.ingressClassName }} + - name: INGRESS_CLASS_NAME + value: "{{ .Values.ingress.ingressClassName }}" + {{- end }} + {{- if .Values.server.stagingServiceAccountName }} + - name: STAGING_SERVICE_ACCOUNT_NAME + value: "{{ .Values.server.stagingServiceAccountName }}" + {{- end }} + {{- with .Values.server.stagingResourceRequests }} + {{- with .cpu }} + - name: STAGING_RESOURCE_CPU + value: "{{ . }}" + {{- end }} + {{- with .memory }} + - name: STAGING_RESOURCE_MEMORY + value: "{{ . }}" + {{- end }} + {{- end }} + {{- if .Values.extraEnv }} + {{- toYaml .Values.extraEnv | nindent 12 -}} + {{- end }} + image: "{{ default .Values.image.epinio.registry (include "registry-url" .) }}{{ .Values.image.epinio.repository }}:{{ default .Chart.AppVersion .Values.image.epinio.tag }}" + livenessProbe: + httpGet: + path: /ready + port: 8030 + name: epinio-server + ports: + - containerPort: 8030 + volumeMounts: + - name: asset-volume + mountPath: /assets + - name: tmp-volume + mountPath: /tmp + - name: image-export-volume + mountPath: /image-export +{{- if .Values.global.dex.enabled }} + - name: dex-tls + mountPath: /etc/ssl/certs/dex-tls.pem + subPath: tls.crt +{{- end }} + readinessProbe: + httpGet: + path: /ready + port: 8030 + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + securityContext: + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 3000 + +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: image-export-pvc + namespace: {{ .Release.Namespace }} +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 2Gi +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: epinio + app.kubernetes.io/instance: default + app.kubernetes.io/name: epinio-server + app.kubernetes.io/part-of: epinio + app.kubernetes.io/version: {{ default .Chart.AppVersion .Values.image.epinio.tag }} + {{- with .Values.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + name: epinio-server + namespace: {{ .Release.Namespace }} +spec: + ports: + - name: http + port: 80 + protocol: TCP + targetPort: 8030 + selector: + app.kubernetes.io/name: epinio-server diff --git a/charts/epinio/102.0.4+up1.9.0/templates/service-catalog.yaml b/charts/epinio/102.0.4+up1.9.0/templates/service-catalog.yaml new file mode 100644 index 000000000..7391c9c38 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/templates/service-catalog.yaml @@ -0,0 +1,118 @@ +# These are three simple Services to fill the Service Catalog +{{ if .Values.serviceCatalog.enableDevServices }} +--- +apiVersion: application.epinio.io/v1 +kind: Service +metadata: + name: postgresql-dev + namespace: {{ .Release.Namespace }} +spec: + name: postgresql-dev + shortDescription: A PostgreSQL service that can be used during development + description: | + This service is going to deploy a simple default Bitnami PostreSQL db instance. + You can find more info at https://github.com/bitnami/charts/tree/master/bitnami/postgresql/. + This database is running inside the cluster so it's probably not a good choice for production + environments, at least with this default configuration. + chart: postgresql + chartVersion: 12.1.6 + serviceIcon: https://bitnami.com/assets/stacks/postgresql/img/postgresql-stack-220x234.png + appVersion: 15.1.0 + helmRepo: + name: bitnami + url: "https://charts.bitnami.com/bitnami" + values: |- + {{- template "epinio.catalog-service-values" . }} +--- +apiVersion: application.epinio.io/v1 +kind: Service +metadata: + name: mysql-dev + namespace: {{ .Release.Namespace }} +spec: + name: mysql-dev + shortDescription: A MySQL service that can be used during development + description: | + This service is going to deploy a simple default Bitnami MySQL db instance. + You can find more info at https://github.com/bitnami/charts/tree/master/bitnami/mysql/. + This database is running inside the cluster so it's probably not a good choice for production + environments, at least with this default configuration. + chart: mysql + chartVersion: 9.4.5 + serviceIcon: https://bitnami.com/assets/stacks/mysql/img/mysql-stack-220x234.png + appVersion: 8.0.31 + helmRepo: + name: bitnami + url: "https://charts.bitnami.com/bitnami" + values: |- + {{- template "epinio.catalog-service-values" . }} +--- +apiVersion: application.epinio.io/v1 +kind: Service +metadata: + name: redis-dev + namespace: {{ .Release.Namespace }} +spec: + name: redis-dev + shortDescription: A Redis service that can be used during development + description: | + This service is going to deploy a simple default Bitnami Redis instance. + You can find more info at https://github.com/bitnami/charts/tree/master/bitnami/redis/. + This database is running inside the cluster so it's probably not a good choice for production + environments, at least with this default configuration. + chart: redis + chartVersion: 17.3.17 + serviceIcon: https://bitnami.com/assets/stacks/redis/img/redis-stack-220x234.png + appVersion: 7.0.7 + helmRepo: + name: bitnami + url: "https://charts.bitnami.com/bitnami" + values: |- + {{- template "epinio.catalog-service-values" . }} +--- +apiVersion: application.epinio.io/v1 +kind: Service +metadata: + name: rabbitmq-dev + namespace: {{ .Release.Namespace }} +spec: + name: rabbitmq-dev + shortDescription: A RabbitMQ service that can be used during development + description: | + This service is going to deploy a simple default Bitnami RabbitMQ instance. + You can find more info at https://github.com/bitnami/charts/tree/master/bitnami/rabbitmq/. + This instance is running inside the cluster so it's probably not a good choice for production + environments, at least with this default configuration. + chart: rabbitmq + chartVersion: 11.2.2 + serviceIcon: https://bitnami.com/assets/stacks/rabbitmq/img/rabbitmq-stack-220x234.png + appVersion: 3.11.5 + helmRepo: + name: bitnami + url: https://charts.bitnami.com/bitnami + values: |- + {{- template "epinio.catalog-service-values" . }} +--- +apiVersion: application.epinio.io/v1 +kind: Service +metadata: + name: mongodb-dev + namespace: {{ .Release.Namespace }} +spec: + name: mongodb-dev + shortDescription: A MongoDB service that can be used during development + description: | + This service is going to deploy a simple default Bitnami MongoDB instance. + You can find more info at https://github.com/bitnami/charts/tree/master/bitnami/mongodb/. + This instance is running inside the cluster so it's probably not a good choice for production + environments, at least with this default configuration. + chart: mongodb + chartVersion: 13.6.2 + serviceIcon: https://bitnami.com/assets/stacks/mongodb/img/mongodb-stack-220x234.png + appVersion: 6.0.3 + helmRepo: + name: bitnami + url: https://charts.bitnami.com/bitnami + values: |- + {{- template "epinio.catalog-service-values" . }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/templates/stage-scripts.yaml b/charts/epinio/102.0.4+up1.9.0/templates/stage-scripts.yaml new file mode 100644 index 000000000..4c17f5325 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/templates/stage-scripts.yaml @@ -0,0 +1,99 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: epinio-stage-scripts + namespace: {{ .Release.Namespace }} +data: + builderImage: "{{ default .Values.image.builder.registry (include "registry-url" .) }}{{ .Values.image.builder.repository}}:{{ .Values.image.builder.tag }}" + downloadImage: "{{ default .Values.image.awscli.registry (include "registry-url" .) }}{{ .Values.image.awscli.repository}}:{{ .Values.image.awscli.tag }}" + unpackImage: "{{ default .Values.image.bash.registry (include "registry-url" .) }}{{ .Values.image.bash.repository}}:{{ default .Chart.AppVersion .Values.image.bash.tag }}" + download: |- + # Parameters + # - PROTOCOL # s3 protocol + # - ENDPOINT # s3 endpoint + # - BUCKET # s3 bucket + # - BLOBID # blob id / file name for source archive + # + # This data is set in the chart only for an external s3. For + # internal s3 the chart has no information. Therefore we cannot + # use helm templating to insert these. + echo By _ _ __ ___ _____ $(whoami) $(pwd) + cat /etc/ssl/certs/ca-bundle.crt > /tmp/ca-bundle.pem + test -f /certs/ca.crt && cat /certs/ca.crt >> /tmp/ca-bundle.pem + test -f /certs/tls.crt && cat /certs/tls.crt >> /tmp/ca-bundle.pem + aws --ca-bundle /tmp/ca-bundle.pem --endpoint-url "${PROTOCOL}://${ENDPOINT}" s3 cp "s3://${BUCKET}/${BLOBID}" "/workspace/source/${BLOBID}" + echo _ _ __ ___ _____ Done + unpack: |- + # Parameters + # - BLOBID # blob id / file name for source archive + # + # Attempting to unpack the sources as, in order: + # .tar - epinio cli + # .zip - epinio UI + # -z .tar.gz + # -j .tar.bz2 + # -J .tar.xz + # + # __Note__: While it would have been nicer, IMNSHO, to use `file` to determine the + # type of the file and then directly dispatch to the proper unpacker, the `file` + # command is not available in the `bash` image. The code as written now relies on each + # unpacker to recognize/reject input properly. + # + echo By _ _ __ ___ _____ $(whoami) $(pwd) + if test ! -f "/workspace/source/${BLOBID}" ; then + echo Nothing to unpack + exit + fi + mkdir /workspace/source/app + ( cd /workspace/source/app + ( echo Tar? ; tar -xvf "../${BLOBID}" ) || \ + ( echo Zip? ; unzip "../${BLOBID}" ) || \ + ( echo Tgz? ; tar -xvzf "../${BLOBID}" ) || \ + ( echo Tbz? ; tar -xvjf "../${BLOBID}" ) || \ + ( echo Txz? ; tar -xvJf "../${BLOBID}" ) || \ + ( echo "Unable to unpack. No supported archive file format found" ; exit 1 ) + echo OK + ) + rm "/workspace/source/${BLOBID}" + mkdir -p /workspace/source/env + cp -vL /workspace/source/appenv/* /workspace/source/env + chown -R 1000:1000 /workspace 2> /dev/null + find /workspace + echo _ _ __ ___ _____ Done + build: |- + # Important doc references + # - BP general: https://github.com/buildpacks/spec/blob/main/platform.md + # - Env setup.: https://github.com/buildpacks/spec/blob/main/platform.md#user-provided-variables + # Parameters + # - PREIMAGE # url of previous image + # - APPIMAGE # url of application image + # + # ATTENTION: The `curl localhost:4191` command is used to stop the linkerd proxy + # container gracefully. We use `|| true` in case linkerd is not deployed. Further, it + # is placed into a trap to ensure that it will always run, even for a staging failure. + # Error output generated when linkerd is not present/up is squashed (dev/null). + # These messages are irrelevant, the situation is not an error, and allowing them through + # would confuse users (readers of app staging logs). + set -e + trap "curl -X POST http://localhost:4191/shutdown 2> /dev/null || true" EXIT + echo By _ _ __ ___ _____ $(whoami) $(pwd) + if test ! -d "/workspace/source/app" ; then + echo Nothing to build + sleep 60 # linkerd is a pain - If we exit to quickly, with the sidecar not ready our curl to shut it down does nothing, and then the sidecar comes up and prevents the pod from ending + exit 1 + fi + find /workspace + for path in /workspace/source/env/* ; do export $(basename ${path})=$(cat $path) ; done + /cnb/lifecycle/creator \ + -app=/workspace/source/app \ + -cache-dir=/workspace/cache \ + -uid=1000 \ + -gid=1000 \ + -layers=/layers \ + -platform=/workspace/source \ + -report=/layers/report.toml \ + -process-type=web \ + -skip-restore=false \ + "-previous-image=${PREIMAGE}" \ + "${APPIMAGE}" + echo _ _ __ ___ _____ Done diff --git a/charts/epinio/102.0.4+up1.9.0/templates/ui/certificate.yaml b/charts/epinio/102.0.4+up1.9.0/templates/ui/certificate.yaml new file mode 100644 index 000000000..87f2c5e99 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/templates/ui/certificate.yaml @@ -0,0 +1,15 @@ +{{- if and .Values.epinioUI.enabled .Values.epinioUI.ingress.enabled }} +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: epinio-ui + namespace: {{ .Release.Namespace }} +spec: + dnsNames: + - {{ .Values.global.domain }} + issuerRef: + kind: ClusterIssuer + name: {{ .Values.global.tlsIssuer }} + secretName: epinio-ui-tls +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/templates/ui/deployment.yaml b/charts/epinio/102.0.4+up1.9.0/templates/ui/deployment.yaml new file mode 100644 index 000000000..20a2d9128 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/templates/ui/deployment.yaml @@ -0,0 +1,121 @@ +{{- if .Values.epinioUI.enabled }} +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: epinio-ui + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: epinio-ui + app.kubernetes.io/instance: {{ .Release.Name }} +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: epinio-ui + app.kubernetes.io/instance: {{ .Release.Name }} + template: + metadata: + labels: + app.kubernetes.io/name: epinio-ui + app.kubernetes.io/instance: {{ .Release.Name }} + spec: + nodeSelector: + {{- include "linux-node-selector" . | nindent 8 }} + tolerations: + {{- include "linux-node-tolerations" . | nindent 8 }} +{{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy" }} +{{- if .Values.global.rbac.pspEnabled }} + serviceAccountName: epinio-ui +{{- end }} +{{- end }} + containers: + - name: epinio-ui + {{ $epinioUiImage := index .Values "image" "epinio-ui" -}} + image: "{{ default $epinioUiImage.registry (include "registry-url" .) }}{{ $epinioUiImage.repository }}:{{ $epinioUiImage.tag }}" + imagePullPolicy: {{ .Values.epinioUI.imagePullPolicy }} + workingDir: /db + + env: + - name: ALLOWED_ORIGINS + value: {{ default (printf "https://epinio.%s" .Values.global.domain) .Values.epinioUI.allowedOrigins }} + - name: EPINIO_API_URL + value: {{ default (printf "http://epinio-server.%s.svc.cluster.local" .Release.Namespace) .Values.epinioUI.apiURL }} + - name: EPINIO_WSS_URL + value: {{ default (printf "ws://epinio-server.%s.svc.cluster.local" .Release.Namespace) .Values.epinioUI.wssURL }} + - name: EPINIO_UI_URL + value: {{ default (printf "https://epinio.%s" .Values.global.domain) .Values.epinioUI.uiURL }} + - name: EPINIO_API_SKIP_SSL + value: {{ (default "false" .Values.epinioUI.apiSkipSSL) | quote }} + - name: EPINIO_THEME + value: {{ (default "light" .Values.epinioUI.theme) | quote }} + {{- if .Values.global.dex.enabled }} + - name: EPINIO_DEX_AUTH_URL + value: {{ default (printf "http://dex.%s.svc.cluster.local:5556" .Release.Namespace) .Values.epinioUI.dexURL }} + - name: EPINIO_DEX_ISSUER + value: {{ printf "https://auth.%s" .Values.global.domain }} + - name: EPINIO_DEX_ENABLED + value: "true" + - name: EPINIO_DEX_SECRET + valueFrom: + secretKeyRef: + name: dex-config + key: uiClientSecret + {{- end }} + - name: HTTP_CLIENT_TIMEOUT_IN_SECS + value: "120" + - name: SESSION_STORE_SECRET + valueFrom: + secretKeyRef: + name: epinio-ui + key: sessionSecret + - name: SESSION_STORE_EXPIRY + value: "1440" + - name: UI_PATH + value: "/ui" + - name: AUTH_ENDPOINT_TYPE + value: epinio + - name: ENCRYPTION_KEY + valueFrom: + secretKeyRef: + name: epinio-ui + key: encryptionKey + + - name: DATABASE_PROVIDER + value: sqlite + - name: HTTPS + value: "false" + - name: CONSOLE_PROXY_TLS_ADDRESS + value: 0.0.0.0:8000 + - name: LOG_LEVEL + value: {{ .Values.epinioUI.logLevel | quote }} + volumeMounts: + - name: tmp + mountPath: /tmp + readOnly: false + - name: db + mountPath: /db + readOnly: false + + securityContext: + runAsUser: 1000 + runAsNonRoot: true + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + livenessProbe: + tcpSocket: + port: 8000 + initialDelaySeconds: 15 + periodSeconds: 20 + readinessProbe: + tcpSocket: + port: 8000 + initialDelaySeconds: 5 + periodSeconds: 5 + volumes: + - name: tmp + emptyDir: {} + - name: db + emptyDir: {} + +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/templates/ui/ingress.yaml b/charts/epinio/102.0.4+up1.9.0/templates/ui/ingress.yaml new file mode 100644 index 000000000..6ebd31ca5 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/templates/ui/ingress.yaml @@ -0,0 +1,30 @@ +{{- if and .Values.epinioUI.enabled .Values.epinioUI.ingress.enabled }} +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + annotations: + traefik.ingress.kubernetes.io/router.entrypoints: websecure + traefik.ingress.kubernetes.io/router.tls: "true" + name: epinio-ui + namespace: {{ .Release.Namespace }} +spec: + {{- if .Values.epinioUI.ingress.ingressClassName }} + ingressClassName: "{{ .Values.ingress.ingressClassName }}" + {{- end }} + rules: + - host: {{ .Values.global.domain }} + http: + paths: + - backend: + service: + name: epinio-ui + port: + number: 80 + path: / + pathType: ImplementationSpecific + tls: + - hosts: + - {{ .Values.global.domain }} + secretName: epinio-ui-tls +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/templates/ui/secret.yaml b/charts/epinio/102.0.4+up1.9.0/templates/ui/secret.yaml new file mode 100644 index 000000000..6d10abe65 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/templates/ui/secret.yaml @@ -0,0 +1,17 @@ +{{- if .Values.epinioUI.enabled }} + +{{- $secret := (lookup "v1" "Secret" .Release.Namespace "epinio-ui").data -}} +{{- $encryptionKey := empty $secret | ternary (printf "%x" (randAscii 32)) (b64dec (default "" $secret.encryptionKey)) -}} +{{- $sessionSecret := empty $secret | ternary (randAlphaNum 16) (b64dec (default "" $secret.sessionSecret)) -}} + +--- +apiVersion: v1 +kind: Secret +type: Opaque +metadata: + name: epinio-ui + namespace: {{ .Release.Namespace }} +stringData: + encryptionKey: {{ $encryptionKey }} + sessionSecret: {{ $sessionSecret }} +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/templates/ui/security.yaml b/charts/epinio/102.0.4+up1.9.0/templates/ui/security.yaml new file mode 100644 index 000000000..1ef8bc5c1 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/templates/ui/security.yaml @@ -0,0 +1,90 @@ +{{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy" -}} +{{- if .Values.global.rbac.pspEnabled }} + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: epinio-ui + namespace: {{ .Release.Namespace }} + +--- +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: epinio-ui-psp + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: "{{ replace "+" "_" .Chart.Version }}" + app.kubernetes.io/part-of: epinio-ui + app: epinio-ui +{{- if .Values.global.rbac.pspAnnotations }} + annotations: {{ toYaml .Values.global.rbac.pspAnnotations | nindent 4 }} +{{- end }} +spec: + privileged: false + hostNetwork: false + hostIPC: false + hostPID: false + runAsUser: + # Permits the container to run with root privileges as well. + rule: 'RunAsAny' + seLinux: + # This policy assumes the nodes are using AppArmor rather than SELinux. + rule: 'RunAsAny' + supplementalGroups: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 0 + max: 65535 + fsGroup: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 0 + max: 65535 + readOnlyRootFilesystem: false + +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: epinio-ui-psp + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: "{{ replace "+" "_" .Chart.Version }}" + app.kubernetes.io/part-of: epinio-ui + app: epinio-ui +rules: +{{- if semverCompare "> 1.15.0-0" .Capabilities.KubeVersion.GitVersion }} +- apiGroups: ['policy'] +{{- else }} +- apiGroups: ['extensions'] +{{- end }} + resources: ['podsecuritypolicies'] + verbs: ['use'] + resourceNames: + - epinio-ui-psp + +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: epinio-ui-psp + labels: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: "{{ replace "+" "_" .Chart.Version }}" + app.kubernetes.io/part-of: epinio-ui + app: epinio-ui +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: epinio-ui-psp +subjects: + - kind: ServiceAccount + name: epinio-ui + namespace: {{ .Release.Namespace }} + +{{- end }} +{{- end -}} diff --git a/charts/epinio/102.0.4+up1.9.0/templates/ui/service.yaml b/charts/epinio/102.0.4+up1.9.0/templates/ui/service.yaml new file mode 100644 index 000000000..27b10fd93 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/templates/ui/service.yaml @@ -0,0 +1,24 @@ +{{- if .Values.epinioUI.enabled }} +--- +apiVersion: v1 +kind: Service +metadata: + name: epinio-ui + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: epinio-ui + app.kubernetes.io/instance: {{ .Release.Name }} + {{- with .Values.epinioUI.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + type: ClusterIP + selector: + app.kubernetes.io/name: epinio-ui + app.kubernetes.io/instance: {{ .Release.Name }} + ports: + - name: ui + port: 80 + targetPort: 8000 +{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/templates/validate-cert-manager-crd.yaml b/charts/epinio/102.0.4+up1.9.0/templates/validate-cert-manager-crd.yaml new file mode 100644 index 000000000..87e12c558 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/templates/validate-cert-manager-crd.yaml @@ -0,0 +1,19 @@ +#{{- if gt (len (lookup "rbac.authorization.k8s.io/v1" "ClusterRole" "" "")) 0 -}} +# {{- $found := dict -}} +# {{- set $found "acme.cert-manager.io/v1/Challenge" false -}} +# {{- set $found "acme.cert-manager.io/v1/Order" false -}} +# {{- set $found "cert-manager.io/v1/CertificateRequest" false -}} +# {{- set $found "cert-manager.io/v1/Certificate" false -}} +# {{- set $found "cert-manager.io/v1/ClusterIssuer" false -}} +# {{- set $found "cert-manager.io/v1/Issuer" false -}} +# {{- range .Capabilities.APIVersions -}} +# {{- if hasKey $found (toString .) -}} +# {{- set $found (toString .) true -}} +# {{- end -}} +# {{- end -}} +# {{- range $_, $exists := $found -}} +# {{- if (eq $exists false) -}} +# {{- required "Required CRDs are missing. Please install the corresponding CRD chart before installing this chart." "" -}} +# {{- end -}} +# {{- end -}} +#{{- end -}} \ No newline at end of file diff --git a/charts/epinio/102.0.4+up1.9.0/templates/validate-install-crd.yaml b/charts/epinio/102.0.4+up1.9.0/templates/validate-install-crd.yaml new file mode 100644 index 000000000..afa6e4fb4 --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/templates/validate-install-crd.yaml @@ -0,0 +1,16 @@ +#{{- if gt (len (lookup "rbac.authorization.k8s.io/v1" "ClusterRole" "" "")) 0 -}} +# {{- $found := dict -}} +# {{- set $found "application.epinio.io/v1/App" false -}} +# {{- set $found "application.epinio.io/v1/AppChart" false -}} +# {{- set $found "application.epinio.io/v1/Service" false -}} +# {{- range .Capabilities.APIVersions -}} +# {{- if hasKey $found (toString .) -}} +# {{- set $found (toString .) true -}} +# {{- end -}} +# {{- end -}} +# {{- range $_, $exists := $found -}} +# {{- if (eq $exists false) -}} +# {{- required "Required CRDs are missing. Please install the corresponding CRD chart before installing this chart." "" -}} +# {{- end -}} +# {{- end -}} +#{{- end -}} \ No newline at end of file diff --git a/charts/epinio/102.0.4+up1.9.0/templates/validate-psp-install.yaml b/charts/epinio/102.0.4+up1.9.0/templates/validate-psp-install.yaml new file mode 100644 index 000000000..28adb785e --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/templates/validate-psp-install.yaml @@ -0,0 +1,7 @@ +#{{- if gt (len (lookup "rbac.authorization.k8s.io/v1" "ClusterRole" "" "")) 0 -}} +#{{- if .Values.global.rbac.pspEnabled }} +#{{- if not (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") }} +#{{- fail "The target cluster does not have the PodSecurityPolicy API resource. Please disable PSPs in this chart before proceeding." -}} +#{{- end }} +#{{- end }} +#{{- end }} diff --git a/charts/epinio/102.0.4+up1.9.0/values.schema.json b/charts/epinio/102.0.4+up1.9.0/values.schema.json new file mode 100644 index 000000000..477cef9ef --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/values.schema.json @@ -0,0 +1,506 @@ +{ + "$schema": "https://json-schema.org/draft-07/schema#", + "title": "Values", + "type": "object", + "properties": { + "image": { + "type": "object", + "properties": { + "epinio": { + "type": "object", + "properties": { + "registry": { + "type": "string" + }, + "repository": { + "type": "string" + }, + "tag": { + "type": "string" + } + } + }, + "bash": { + "type": "object", + "properties": { + "repository": { + "type": "string" + }, + "tag": { + "type": "string" + } + } + }, + "awscli": { + "type": "object", + "properties": { + "repository": { + "type": "string" + }, + "tag": { + "type": "string" + } + } + }, + "kubectl": { + "type": "object", + "properties": { + "repository": { + "type": "string" + }, + "tag": { + "type": "string" + } + } + } + } + }, + "server": { + "description": "server configuration", + "type": "object", + "properties": { + "accessControlAllowOrigin": { + "type": "string" + }, + "timeoutMultiplier": { + "type": "integer" + }, + "traceLevel": { + "type": "integer" + }, + "disableTracking": { + "type": "boolean" + }, + "registryCertificateSecret": { + "type": "string" + }, + "ingressClassName": { + "type": "string" + }, + "stagingServiceAccountName": { + "type": "string" + }, + "stagingResourceRequests": { + "type": "object", + "properties": { + "cpu": { + "type": "string" + }, + "memory": { + "type": "string" + } + } + } + } + }, + "ingress": { + "ingressClassName": { + "type": "string" + }, + "annotations": { + "type": "object" + }, + "nginxSSLRedirect": { + "type": "string" + } + }, + "s3": { + "description": "s3 connection details", + "type": "object", + "properties": { + "endpoint": { + "type": "string" + }, + "bucket": { + "type": "string" + }, + "region": { + "type": "string" + }, + "accessKeyID": { + "type": "string" + }, + "secretAccessKey": { + "type": "string" + }, + "certificateSecret": { + "type": "string" + }, + "useSSL": { + "type": "boolean" + } + }, + "required": [ + "endpoint", + "bucket", + "accessKeyID", + "secretAccessKey" + ] + }, + "api": { + "description": "API access configuration", + "type": "object", + "properties": { + "users": { + "description": "Default Epinio users", + "type": "array", + "items": { + "type": "object", + "properties": { + "username": { + "type": "string" + }, + "passwordBcrypt": { + "type": "string" + }, + "role": { + "type": "string" + }, + "workspaces": { + "type": "array", + "items": { + "type": "string" + } + } + }, + "required": [ + "username", + "passwordBcrypt", + "role" + ] + } + } + } + }, + "certManagerNamespace": { + "description": "the namespace there cert-manager controller is deployed", + "type": "string" + }, + "domain": { + "description": "the domain that will be used to access the Epinio API", + "type": "string" + }, + "global": { + "type": "object", + "properties": { + "cattle": { + "type": "object", + "properties": { + "systemDefaultRegistry": { + "type": "string" + } + } + }, + "domain": { + "type": "string" + }, + "tlsIssuer": { + "type": "string" + }, + "tlsIssuerMail": { + "type": "string" + }, + "registryURL": { + "type": "string" + }, + "registryUsername": { + "type": "string" + }, + "registryPassword": { + "type": "string" + }, + "registryNamespace": { + "type": "string" + } + }, + "required": [ + "domain" + ] + }, + "containerregistry": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + }, + "image": { + "type": "object", + "properties": { + "nginx": { + "type": "object", + "properties": { + "repository": { + "type": "string" + }, + "tag": { + "type": "string" + } + } + }, + "registry": { + "type": "object", + "properties": { + "repository": { + "type": "string" + }, + "tag": { + "type": "string" + } + } + } + }, + "required": [ + "nginx", + "registry" + ] + }, + "imagePullPolicy": { + "type": "string" + }, + "ingressClassName": { + "type": "string" + } + }, + "required": [ + "enabled", + "image", + "imagePullPolicy", + "ingressClassName" + ] + }, + "dex": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + }, + "fullnameOverride": { + "type": "string" + }, + "configSecret": { + "type": "object", + "properties": { + "create": { + "type": "boolean" + }, + "name": { + "type": "string" + } + }, + "required": [ + "create", + "name" + ] + } + }, + "required": [ + "configSecret", + "fullnameOverride" + ] + }, + "epinio-ui": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + }, + "ingress": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + } + }, + "required": [ + "enabled" + ] + } + }, + "required": [ + "enabled", + "ingress" + ] + }, + "kubed": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + }, + "enableAnalytics": { + "type": "boolean" + }, + "fullnameOverride": { + "type": "string" + } + }, + "required": [ + "enabled", + "enableAnalytics", + "fullnameOverride" + ] + }, + "minio": { + "type": "object", + "properties": { + "drivesPerNode": { + "type": "integer" + }, + "enabled": { + "type": "boolean" + }, + "existingSecret": { + "type": "string" + }, + "fullnameOverride": { + "type": "string" + }, + "makeUserJob": { + "type": "object", + "properties": { + "podAnnotations": { + "type": "object" + } + }, + "required": [ + "podAnnotations" + ] + }, + "persistence": { + "type": "object", + "properties": { + "size": { + "type": "string" + } + }, + "required": [ + "size" + ] + }, + "replicas": { + "type": "integer" + }, + "resources": { + "type": "object", + "properties": { + "requests": { + "type": "object", + "properties": { + "memory": { + "type": "string" + } + }, + "required": [ + "memory" + ] + } + }, + "required": [ + "requests" + ] + }, + "tls": { + "type": "object", + "properties": { + "certSecret": { + "type": "string" + }, + "enabled": { + "type": "boolean" + }, + "privateKey": { + "type": "string" + }, + "publicCrt": { + "type": "string" + } + }, + "required": [ + "certSecret", + "enabled", + "privateKey", + "publicCrt" + ] + } + }, + "required": [ + "drivesPerNode", + "enabled", + "existingSecret", + "fullnameOverride", + "makeUserJob", + "persistence", + "replicas", + "resources", + "tls" + ] + }, + "s3gw": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + }, + "ingress": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + } + }, + "required": [ + "enabled" + ] + }, + "ui": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + } + }, + "required": [ + "enabled" + ] + }, + "serviceName": { + "type": "string" + }, + "useExistingSecret": { + "type": "boolean" + }, + "storageSize": { + "type": "string" + }, + "storageClass": { + "type": "object", + "properties": { + "create": { + "type": "boolean" + }, + "name": { + "type": "string" + } + }, + "required": [ + "create", + "name" + ] + } + }, + "required": [ + "enabled", + "ingress", + "ui", + "serviceName", + "useExistingSecret", + "storageSize", + "storageClass" + ] + } + }, + "required": [ + "certManagerNamespace", + "s3" + ] +} diff --git a/charts/epinio/102.0.4+up1.9.0/values.yaml b/charts/epinio/102.0.4+up1.9.0/values.yaml new file mode 100644 index 000000000..0c31b0bbd --- /dev/null +++ b/charts/epinio/102.0.4+up1.9.0/values.yaml @@ -0,0 +1,216 @@ +## Default values for Epinio Helm Chart. +## This is a YAML-formatted file. +## Declare variables to be passed into your templates. +# Fall back email address to receive notifications from the `letsencrypt-production` issuer. +# +# __SUPERCEDED__ by `global.tlsIssuerMail`. +# +# Kept for backward compatibility, here and in the templates. +email: "epinio@suse.com" +image: + epinio: + repository: rancher/mirrored-epinio-epinio-server + tag: v1.9.0 + epinio-ui: + repository: rancher/mirrored-epinio-epinio-ui + tag: v1.9.0-0.0.3 + bash: + repository: rancher/mirrored-epinio-epinio-unpacker + tag: v1.9.0 + awscli: + repository: rancher/mirrored-amazon-aws-cli + tag: 2.9.14 + skopeo: + repository: rancher/mirrored-skopeo-skopeo + tag: v1.10.0 + kubectl: + repository: rancher/kubectl + tag: v1.22.6 + builder: + repository: rancher/mirrored-paketobuildpacks-builder + tag: 0.2.441-full +appChart: + default: /assets/epinio-application-0.1.26.tgz +server: + # Domain which serves the Rancher UI (to access the API) + accessControlAllowOrigin: "" + # increase this value to increase all timeouts by the same factor + timeoutMultiplier: 1 + # Increase this value to instruct the API server to produce more debug output + traceLevel: 0 + # The ingressClassName is used to select the ingress controller for apps. + # If empty ingress.ingressClassName (see below) is used + ingressClassName: "" + # Disable tracking of the Epinio and Kubernetes cluster version + disableTracking: false + # Name of the Service Account used by the staging job + stagingServiceAccountName: "" + # Resources to allocate to the staging job. Default: unbounded + stagingResourceRequests: + cpu: "" + memory: "" +ingress: + # The ingressClassName is used to select the ingress controller for the server. If empty no class will be added to the ingresses. + ingressClassName: "" + # Annotations to add to the API ingress + # e.g.: --set 'ingress.annotations.nginx\.ingress\.kubernetes\.io/ssl-redirect=false' + annotations: {} + # nginxSSLRedirect to controll https->http redirects + nginxSSLRedirect: "true" +service: + # -- Annotations to be added to the Epinio service. + annotations: {} +# The strategy used to deploy the Epinio server. +# If you are using a RWO storage the following will avoid a Multi-Attach error during an `helm upgrade`. +# See https://github.com/epinio/epinio/issues/2253. +strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 0 + maxUnavailable: 1 +certManagerNamespace: cert-manager +# Connection details for the S3 storage +s3: + endpoint: s3.amazonaws.com + bucket: "epinio" + region: "" + accessKeyID: "" + secretAccessKey: "" + useSSL: true + # Set it to an existing secret if S3 is using a self signed cert + certificateSecret: "" +api: + # Default users + users: + - username: admin + passwordBcrypt: "$2a$10$6bCi5NMstMK781In7JGiL.B44pgoplUb330FQvm6mVXMppbXBPiXS" + role: admin + - username: epinio + passwordBcrypt: "$2a$10$6bCi5NMstMK781In7JGiL.B44pgoplUb330FQvm6mVXMppbXBPiXS" + role: user + workspaces: + - workspace +# Dex subchart values -- None for now, and sub chart disabled +dex: + # hardcode this, to avoid problems with release name + fullnameOverride: "dex" + configSecret: + create: false + name: "dex-config" + ui: + # secret should be supplied by dex automatically, this is just a fall back + secret: "" + # Defaults to https://epinio.{{ .Values.global.domain }}/auth/verify/ + redirectURI: "" + service: + # -- Annotations to be added to the Epinio service. + annotations: {} +# Extra environment variables passed to the epinio-server pod. +# extraEnv: +# - name: MY_ENV_VAR +# value: "1.0" +# Minio subchart values +minio: + enabled: true + # hardcode this, to avoid problems with release name + fullnameOverride: minio + existingSecret: minio-creds + tls: + enabled: true + certSecret: minio-tls + publicCrt: tls.crt + privateKey: tls.key + persistence: + size: 2Gi + drivesPerNode: 4 + replicas: 1 + resources: + requests: + memory: 1Gi + makeUserJob: + podAnnotations: + linkerd.io/inject: disabled +epinioUI: + enabled: true + # UI theme, either 'light' or 'dark' + theme: light + imagePullPolicy: IfNotPresent + # API URL of epinio instance, for proxied connections, defaults to http://epinio-server.%s.svc.cluster.local" + apiURL: "" + wssURL: "" + dexURL: "" + uiURL: "" + # Skip checking for valid SSL cert when making requests to `EPINIO_API_URL` + apiSkipSSL: "true" + logLevel: info + # Domain that will serve the UI and be the origin of browser requests, used by CORS process + allowedOrigins: "" + ingress: + enabled: false + # The ingressClassName is used to select the ingress controller. If empty no class will be added to the ingresses. + ingressClassName: "" + service: + # -- Annotations to be added to the service. + annotations: {} +kubed: + enabled: true + fullnameOverride: kubed + enableAnalytics: false +# s3gw subchart values +s3gw: + enabled: false + ingress: + enabled: false + ui: + enabled: false + serviceName: s3gw + useExistingSecret: true + defaultUserCredentialsSecret: s3gw-creds + storageSize: 2Gi + storageClass: + create: false + name: "" +containerregistry: + enabled: true + image: + registry: + repository: rancher/mirrored-library-registry + tag: 2.8.1 + nginx: + repository: rancher/mirrored-library-nginx + tag: 1.23.2-alpine + imagePullPolicy: IfNotPresent + # The ingressClassName is used to select the ingress controller. If + # empty no class will be added to the ingresses. + ingressClassName: "" + # The certificateSecret is used to load the certificate of the registry in the staging job. + # The certificate has to be in PEM format within in a 'tls.crt' key (it can be an Opaque secret). + # It also has to be trusted by the kubelet, and it needs to be added in the cluster as well. + certificateSecret: "" +serviceCatalog: + # Enable service catalog service for development + enableDevServices: true +global: + rbac: + pspEnabled: false + dex: + enabled: true + # The domain that will be used to access the epinio API server and the registry + domain: "" + # Connection details for the container registry. + # Skip if containerregistry.enabled is true + registryURL: "" + registryUsername: "admin" + registryPassword: "changeme" + # Used in registry path when pushing -> "external.tld/apps/APPNAME" + registryNamespace: "apps" + # The name of the cluster issuer to use. + # Epinio creates three options: 'epinio-ca', 'letsencrypt-production', and 'selfsigned-issuer'. + tlsIssuer: "epinio-ca" + # Email address to receive the certificate notification emails send by the `letsencrypt-production` issuer. + tlsIssuerEmail: "epinio@suse.com" + # The URL of the container registry from where to pull container images for the various + # created Pods. Don't confuse this registry with the "Epinio registry" which is the one + # where Epinio stores the application images. + cattle: + systemDefaultRegistry: "" diff --git a/charts/fleet-agent/102.2.0+up0.8.0/Chart.yaml b/charts/fleet-agent/102.2.0+up0.8.0/Chart.yaml new file mode 100644 index 000000000..1b9aedab8 --- /dev/null +++ b/charts/fleet-agent/102.2.0+up0.8.0/Chart.yaml @@ -0,0 +1,15 @@ +annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/kube-version: '>= 1.16.0-0 < 1.27.0-0' + catalog.cattle.io/namespace: cattle-fleet-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/rancher-version: '>= 2.7.0-0 < 2.8.0-0' + catalog.cattle.io/release-name: fleet-agent +apiVersion: v2 +appVersion: 0.8.0 +description: Fleet Manager Agent - GitOps at Scale +icon: https://charts.rancher.io/assets/logos/fleet.svg +name: fleet-agent +version: 102.2.0+up0.8.0 diff --git a/charts/fleet-agent/102.2.0+up0.8.0/README.md b/charts/fleet-agent/102.2.0+up0.8.0/README.md new file mode 100644 index 000000000..2c5724dce --- /dev/null +++ b/charts/fleet-agent/102.2.0+up0.8.0/README.md @@ -0,0 +1,8 @@ +## Fleet Agent Helm Chart + +Every Fleet-managed downstream cluster will run an agent that communicates back to the Fleet controller. This agent is just another set of Kubernetes controllers running in the downstream cluster. + +Standalone Fleet users use this chart for agent-initiated registration. For more details see [agent-initiated registration](https://fleet.rancher.io/cluster-registration#agent-initiated). +Fleet in Rancher does not use this chart, but creates the agent deployments programmatically. + +The Fleet documentation is centralized in the [doc website](https://fleet.rancher.io/). \ No newline at end of file diff --git a/charts/fleet-agent/102.2.0+up0.8.0/templates/_helpers.tpl b/charts/fleet-agent/102.2.0+up0.8.0/templates/_helpers.tpl new file mode 100644 index 000000000..6cd96c3ac --- /dev/null +++ b/charts/fleet-agent/102.2.0+up0.8.0/templates/_helpers.tpl @@ -0,0 +1,22 @@ +{{- define "system_default_registry" -}} +{{- if .Values.global.cattle.systemDefaultRegistry -}} +{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}} +{{- else -}} +{{- "" -}} +{{- end -}} +{{- end -}} + +{{/* +Windows cluster will add default taint for linux nodes, +add below linux tolerations to workloads could be scheduled to those linux nodes +*/}} +{{- define "linux-node-tolerations" -}} +- key: "cattle.io/os" + value: "linux" + effect: "NoSchedule" + operator: "Equal" +{{- end -}} + +{{- define "linux-node-selector" -}} +kubernetes.io/os: linux +{{- end -}} \ No newline at end of file diff --git a/charts/fleet-agent/102.2.0+up0.8.0/templates/configmap.yaml b/charts/fleet-agent/102.2.0+up0.8.0/templates/configmap.yaml new file mode 100644 index 000000000..ce61a8756 --- /dev/null +++ b/charts/fleet-agent/102.2.0+up0.8.0/templates/configmap.yaml @@ -0,0 +1,12 @@ +kind: ConfigMap +apiVersion: v1 +metadata: + name: fleet-agent +data: + config: |- + { + {{ if .Values.labels }} + "labels":{{toJson .Values.labels}}, + {{ end }} + "clientID":"{{.Values.clientID}}" + } diff --git a/charts/fleet-agent/102.2.0+up0.8.0/templates/deployment.yaml b/charts/fleet-agent/102.2.0+up0.8.0/templates/deployment.yaml new file mode 100644 index 000000000..582eed608 --- /dev/null +++ b/charts/fleet-agent/102.2.0+up0.8.0/templates/deployment.yaml @@ -0,0 +1,51 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: fleet-agent +spec: + selector: + matchLabels: + app: fleet-agent + template: + metadata: + labels: + app: fleet-agent + spec: + containers: + - env: + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + image: '{{ template "system_default_registry" . }}{{.Values.image.repository}}:{{.Values.image.tag}}' + name: fleet-agent + command: + - fleetagent + {{- if .Values.debug }} + - --debug + - --debug-level + - {{ quote .Values.debugLevel }} + {{- else }} + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + privileged: false + capabilities: + drop: + - ALL + {{- end }} + serviceAccountName: fleet-agent + nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} +{{- if .Values.fleetAgent.nodeSelector }} +{{ toYaml .Values.fleetAgent.nodeSelector | indent 8 }} +{{- end }} + tolerations: {{ include "linux-node-tolerations" . | nindent 8 }} +{{- if .Values.fleetAgent.tolerations }} +{{ toYaml .Values.fleetAgent.tolerations | indent 8 }} +{{- end }} +{{- if not .Values.debug }} + securityContext: + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 1000 +{{- end }} diff --git a/charts/fleet-agent/102.2.0+up0.8.0/templates/network_policy_allow_all.yaml b/charts/fleet-agent/102.2.0+up0.8.0/templates/network_policy_allow_all.yaml new file mode 100644 index 000000000..a72109a06 --- /dev/null +++ b/charts/fleet-agent/102.2.0+up0.8.0/templates/network_policy_allow_all.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: default-allow-all + namespace: {{ .Values.internal.systemNamespace }} +spec: + podSelector: {} + ingress: + - {} + egress: + - {} + policyTypes: + - Ingress + - Egress diff --git a/charts/fleet-agent/102.2.0+up0.8.0/templates/patch_default_serviceaccount.yaml b/charts/fleet-agent/102.2.0+up0.8.0/templates/patch_default_serviceaccount.yaml new file mode 100644 index 000000000..aad4eea41 --- /dev/null +++ b/charts/fleet-agent/102.2.0+up0.8.0/templates/patch_default_serviceaccount.yaml @@ -0,0 +1,28 @@ +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: patch-fleet-sa + annotations: + "helm.sh/hook": post-install, post-upgrade + "helm.sh/hook-delete-policy": hook-succeeded, before-hook-creation +spec: + template: + spec: + serviceAccountName: fleet-agent + restartPolicy: Never + containers: + - name: sa + image: "{{ template "system_default_registry" . }}{{ .Values.global.kubectl.repository }}:{{ .Values.global.kubectl.tag }}" + imagePullPolicy: {{ .Values.global.imagePullPolicy }} + command: ["kubectl", "patch", "serviceaccount", "default", "-p", "{\"automountServiceAccountToken\": false}"] + args: ["-n", {{ .Values.internal.systemNamespace }}] + nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} +{{- if .Values.kubectl.nodeSelector }} +{{ toYaml .Values.kubectl.nodeSelector | indent 8 }} +{{- end }} + tolerations: {{ include "linux-node-tolerations" . | nindent 8 }} +{{- if .Values.kubectl.tolerations }} +{{ toYaml .Values.kubectl.tolerations | indent 8 }} +{{- end }} + backoffLimit: 1 diff --git a/charts/fleet-agent/102.2.0+up0.8.0/templates/rbac.yaml b/charts/fleet-agent/102.2.0+up0.8.0/templates/rbac.yaml new file mode 100644 index 000000000..805949bf2 --- /dev/null +++ b/charts/fleet-agent/102.2.0+up0.8.0/templates/rbac.yaml @@ -0,0 +1,25 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: fleet-agent-system-fleet-agent-role +rules: +- apiGroups: + - '*' + resources: + - '*' + verbs: + - '*' + +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: fleet-agent-system-fleet-agent-role-binding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: fleet-agent-system-fleet-agent-role +subjects: +- kind: ServiceAccount + name: fleet-agent + namespace: {{.Release.Namespace}} diff --git a/charts/fleet-agent/102.2.0+up0.8.0/templates/secret.yaml b/charts/fleet-agent/102.2.0+up0.8.0/templates/secret.yaml new file mode 100644 index 000000000..471588204 --- /dev/null +++ b/charts/fleet-agent/102.2.0+up0.8.0/templates/secret.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +data: + systemRegistrationNamespace: "{{b64enc .Values.systemRegistrationNamespace}}" + clusterNamespace: "{{b64enc .Values.clusterNamespace}}" + token: "{{b64enc .Values.token}}" + apiServerURL: "{{b64enc .Values.apiServerURL}}" + apiServerCA: "{{b64enc .Values.apiServerCA}}" +kind: Secret +metadata: + name: fleet-agent-bootstrap diff --git a/charts/fleet-agent/102.2.0+up0.8.0/templates/serviceaccount.yaml b/charts/fleet-agent/102.2.0+up0.8.0/templates/serviceaccount.yaml new file mode 100644 index 000000000..73e27f0be --- /dev/null +++ b/charts/fleet-agent/102.2.0+up0.8.0/templates/serviceaccount.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: fleet-agent diff --git a/charts/fleet-agent/102.2.0+up0.8.0/templates/validate.yaml b/charts/fleet-agent/102.2.0+up0.8.0/templates/validate.yaml new file mode 100644 index 000000000..d53ff1c50 --- /dev/null +++ b/charts/fleet-agent/102.2.0+up0.8.0/templates/validate.yaml @@ -0,0 +1,11 @@ +{{if ne .Release.Namespace .Values.internal.systemNamespace }} +{{ fail (printf "This chart must be installed in the namespace %s as the release name fleet-agent" .Values.internal.systemNamespace) }} +{{end}} + +{{if ne .Release.Name .Values.internal.managedReleaseName }} +{{ fail (printf "This chart must be installed in the namespace %s as the release name fleet-agent" .Values.internal.managedReleaseName) }} +{{end}} + +{{if not .Values.apiServerURL }} +{{ fail "apiServerURL is required to be set, and most likely also apiServerCA" }} +{{end}} diff --git a/charts/fleet-agent/102.2.0+up0.8.0/values.yaml b/charts/fleet-agent/102.2.0+up0.8.0/values.yaml new file mode 100644 index 000000000..d4edc52af --- /dev/null +++ b/charts/fleet-agent/102.2.0+up0.8.0/values.yaml @@ -0,0 +1,63 @@ +image: + os: "windows,linux" + repository: rancher/fleet-agent + tag: v0.8.0 + +# The public URL of the Kubernetes API server running the Fleet Manager must be set here +# Example: https://example.com:6443 +apiServerURL: "" + +# The the pem encoded value of the CA of the Kubernetes API server running the Fleet Manager. +# If left empty it is assumed this Kubernetes API TLS is signed by a well known CA. +apiServerCA: "" + +# The cluster registration value +token: "" + +# Labels to add to the cluster upon registration only. They are not added after the fact. +#labels: +# foo: bar + +# The client ID of the cluster to associate with +clientID: "" + +# The namespace of the cluster we are register with +clusterNamespace: "" + +# The namespace containing the clusters registration secrets +systemRegistrationNamespace: cattle-fleet-clusters-system + +# Please do not change the below setting unless you really know what you are doing +internal: + systemNamespace: cattle-fleet-system + managedReleaseName: fleet-agent + +# The nodeSelector and tolerations for the agent deployment +fleetAgent: + ## Node labels for pod assignment + ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## + nodeSelector: {} + ## List of node taints to tolerate (requires Kubernetes >= 1.6) + tolerations: [] +kubectl: + ## Node labels for pod assignment + ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## + nodeSelector: {} + ## List of node taints to tolerate (requires Kubernetes >= 1.6) + tolerations: + - key: node.cloudprovider.kubernetes.io/uninitialized + operator: "Equal" + value: "true" + effect: NoSchedule + +global: + cattle: + systemDefaultRegistry: "" + kubectl: + repository: rancher/kubectl + tag: v1.21.5 + +debug: false +debugLevel: 0 diff --git a/charts/fleet-crd/102.2.0+up0.8.0/Chart.yaml b/charts/fleet-crd/102.2.0+up0.8.0/Chart.yaml new file mode 100644 index 000000000..d7cafe522 --- /dev/null +++ b/charts/fleet-crd/102.2.0+up0.8.0/Chart.yaml @@ -0,0 +1,13 @@ +annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/namespace: cattle-fleet-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/release-name: fleet-crd +apiVersion: v2 +appVersion: 0.8.0 +description: Fleet Manager CustomResourceDefinitions +icon: https://charts.rancher.io/assets/logos/fleet.svg +name: fleet-crd +version: 102.2.0+up0.8.0 diff --git a/charts/fleet-crd/102.2.0+up0.8.0/README.md b/charts/fleet-crd/102.2.0+up0.8.0/README.md new file mode 100644 index 000000000..2452ab2f1 --- /dev/null +++ b/charts/fleet-crd/102.2.0+up0.8.0/README.md @@ -0,0 +1,5 @@ +# Fleet CRD Helm Chart + +Fleet Manager CustomResourceDefinitions Helm chart is a requirement for the Fleet Helm Chart. + +The Fleet documentation is centralized in the [doc website](https://fleet.rancher.io/). \ No newline at end of file diff --git a/charts/fleet-crd/102.2.0+up0.8.0/templates/crds.yaml b/charts/fleet-crd/102.2.0+up0.8.0/templates/crds.yaml new file mode 100644 index 000000000..16f8db2e1 --- /dev/null +++ b/charts/fleet-crd/102.2.0+up0.8.0/templates/crds.yaml @@ -0,0 +1,3444 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: bundles.fleet.cattle.io +spec: + group: fleet.cattle.io + names: + kind: Bundle + plural: bundles + singular: bundle + preserveUnknownFields: false + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.display.readyClusters + name: BundleDeployments-Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + spec: + properties: + correctDrift: + properties: + enabled: + type: boolean + force: + type: boolean + keepFailHistory: + type: boolean + type: object + defaultNamespace: + nullable: true + type: string + dependsOn: + items: + properties: + name: + nullable: true + type: string + selector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + type: object + nullable: true + type: array + diff: + nullable: true + properties: + comparePatches: + items: + properties: + apiVersion: + nullable: true + type: string + jsonPointers: + items: + nullable: true + type: string + nullable: true + type: array + kind: + nullable: true + type: string + name: + nullable: true + type: string + namespace: + nullable: true + type: string + operations: + items: + properties: + op: + nullable: true + type: string + path: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + type: object + nullable: true + type: array + type: object + forceSyncGeneration: + type: integer + helm: + nullable: true + properties: + atomic: + type: boolean + chart: + nullable: true + type: string + disablePreProcess: + type: boolean + force: + type: boolean + maxHistory: + type: integer + releaseName: + maxLength: 53 + nullable: true + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + repo: + nullable: true + type: string + takeOwnership: + type: boolean + timeoutSeconds: + type: integer + values: + nullable: true + type: object + x-kubernetes-preserve-unknown-fields: true + valuesFiles: + items: + nullable: true + type: string + nullable: true + type: array + valuesFrom: + items: + properties: + configMapKeyRef: + nullable: true + properties: + key: + nullable: true + type: string + name: + nullable: true + type: string + namespace: + nullable: true + type: string + type: object + secretKeyRef: + nullable: true + properties: + key: + nullable: true + type: string + name: + nullable: true + type: string + namespace: + nullable: true + type: string + type: object + type: object + nullable: true + type: array + version: + nullable: true + type: string + waitForJobs: + type: boolean + type: object + ignore: + properties: + conditions: + items: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + nullable: true + type: array + type: object + keepResources: + type: boolean + kustomize: + nullable: true + properties: + dir: + nullable: true + type: string + type: object + namespace: + nullable: true + type: string + namespaceAnnotations: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + namespaceLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + paused: + type: boolean + resources: + items: + properties: + content: + nullable: true + type: string + encoding: + nullable: true + type: string + name: + nullable: true + type: string + type: object + nullable: true + type: array + rolloutStrategy: + nullable: true + properties: + autoPartitionSize: + nullable: true + type: string + maxUnavailable: + nullable: true + type: string + maxUnavailablePartitions: + nullable: true + type: string + partitions: + items: + properties: + clusterGroup: + nullable: true + type: string + clusterGroupSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + clusterName: + nullable: true + type: string + clusterSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + maxUnavailable: + nullable: true + type: string + name: + nullable: true + type: string + type: object + nullable: true + type: array + type: object + serviceAccount: + nullable: true + type: string + targetRestrictions: + items: + properties: + clusterGroup: + nullable: true + type: string + clusterGroupSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + clusterName: + nullable: true + type: string + clusterSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + name: + nullable: true + type: string + type: object + nullable: true + type: array + targets: + items: + properties: + clusterGroup: + nullable: true + type: string + clusterGroupSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + clusterName: + nullable: true + type: string + clusterSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + correctDrift: + properties: + enabled: + type: boolean + force: + type: boolean + keepFailHistory: + type: boolean + type: object + defaultNamespace: + nullable: true + type: string + diff: + nullable: true + properties: + comparePatches: + items: + properties: + apiVersion: + nullable: true + type: string + jsonPointers: + items: + nullable: true + type: string + nullable: true + type: array + kind: + nullable: true + type: string + name: + nullable: true + type: string + namespace: + nullable: true + type: string + operations: + items: + properties: + op: + nullable: true + type: string + path: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + type: object + nullable: true + type: array + type: object + doNotDeploy: + type: boolean + forceSyncGeneration: + type: integer + helm: + nullable: true + properties: + atomic: + type: boolean + chart: + nullable: true + type: string + disablePreProcess: + type: boolean + force: + type: boolean + maxHistory: + type: integer + releaseName: + nullable: true + type: string + repo: + nullable: true + type: string + takeOwnership: + type: boolean + timeoutSeconds: + type: integer + values: + nullable: true + type: object + x-kubernetes-preserve-unknown-fields: true + valuesFiles: + items: + nullable: true + type: string + nullable: true + type: array + valuesFrom: + items: + properties: + configMapKeyRef: + nullable: true + properties: + key: + nullable: true + type: string + name: + nullable: true + type: string + namespace: + nullable: true + type: string + type: object + secretKeyRef: + nullable: true + properties: + key: + nullable: true + type: string + name: + nullable: true + type: string + namespace: + nullable: true + type: string + type: object + type: object + nullable: true + type: array + version: + nullable: true + type: string + waitForJobs: + type: boolean + type: object + ignore: + properties: + conditions: + items: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + nullable: true + type: array + type: object + keepResources: + type: boolean + kustomize: + nullable: true + properties: + dir: + nullable: true + type: string + type: object + name: + nullable: true + type: string + namespace: + nullable: true + type: string + namespaceAnnotations: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + namespaceLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + serviceAccount: + nullable: true + type: string + yaml: + nullable: true + properties: + overlays: + items: + nullable: true + type: string + nullable: true + type: array + type: object + type: object + nullable: true + type: array + yaml: + nullable: true + properties: + overlays: + items: + nullable: true + type: string + nullable: true + type: array + type: object + type: object + status: + properties: + conditions: + items: + properties: + lastTransitionTime: + nullable: true + type: string + lastUpdateTime: + nullable: true + type: string + message: + nullable: true + type: string + reason: + nullable: true + type: string + status: + nullable: true + type: string + type: + nullable: true + type: string + type: object + nullable: true + type: array + display: + properties: + readyClusters: + nullable: true + type: string + state: + nullable: true + type: string + type: object + maxNew: + type: integer + maxUnavailable: + type: integer + maxUnavailablePartitions: + type: integer + newlyCreated: + type: integer + observedGeneration: + type: integer + partitions: + items: + properties: + count: + type: integer + maxUnavailable: + type: integer + name: + nullable: true + type: string + summary: + properties: + desiredReady: + type: integer + errApplied: + type: integer + modified: + type: integer + nonReadyResources: + items: + properties: + bundleState: + nullable: true + type: string + message: + nullable: true + type: string + modifiedStatus: + items: + properties: + apiVersion: + nullable: true + type: string + delete: + type: boolean + kind: + nullable: true + type: string + missing: + type: boolean + name: + nullable: true + type: string + namespace: + nullable: true + type: string + patch: + nullable: true + type: string + type: object + nullable: true + type: array + name: + nullable: true + type: string + nonReadyStatus: + items: + properties: + apiVersion: + nullable: true + type: string + kind: + nullable: true + type: string + name: + nullable: true + type: string + namespace: + nullable: true + type: string + summary: + properties: + error: + type: boolean + message: + items: + nullable: true + type: string + nullable: true + type: array + state: + nullable: true + type: string + transitioning: + type: boolean + type: object + uid: + nullable: true + type: string + type: object + nullable: true + type: array + type: object + nullable: true + type: array + notReady: + type: integer + outOfSync: + type: integer + pending: + type: integer + ready: + type: integer + waitApplied: + type: integer + type: object + unavailable: + type: integer + type: object + nullable: true + type: array + resourceKey: + items: + properties: + apiVersion: + nullable: true + type: string + kind: + nullable: true + type: string + name: + nullable: true + type: string + namespace: + nullable: true + type: string + type: object + nullable: true + type: array + summary: + properties: + desiredReady: + type: integer + errApplied: + type: integer + modified: + type: integer + nonReadyResources: + items: + properties: + bundleState: + nullable: true + type: string + message: + nullable: true + type: string + modifiedStatus: + items: + properties: + apiVersion: + nullable: true + type: string + delete: + type: boolean + kind: + nullable: true + type: string + missing: + type: boolean + name: + nullable: true + type: string + namespace: + nullable: true + type: string + patch: + nullable: true + type: string + type: object + nullable: true + type: array + name: + nullable: true + type: string + nonReadyStatus: + items: + properties: + apiVersion: + nullable: true + type: string + kind: + nullable: true + type: string + name: + nullable: true + type: string + namespace: + nullable: true + type: string + summary: + properties: + error: + type: boolean + message: + items: + nullable: true + type: string + nullable: true + type: array + state: + nullable: true + type: string + transitioning: + type: boolean + type: object + uid: + nullable: true + type: string + type: object + nullable: true + type: array + type: object + nullable: true + type: array + notReady: + type: integer + outOfSync: + type: integer + pending: + type: integer + ready: + type: integer + waitApplied: + type: integer + type: object + unavailable: + type: integer + unavailablePartitions: + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} + +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: bundledeployments.fleet.cattle.io +spec: + group: fleet.cattle.io + names: + kind: BundleDeployment + plural: bundledeployments + singular: bundledeployment + preserveUnknownFields: false + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.display.deployed + name: Deployed + type: string + - jsonPath: .status.display.monitored + name: Monitored + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + spec: + properties: + correctDrift: + properties: + enabled: + type: boolean + force: + type: boolean + keepFailHistory: + type: boolean + type: object + dependsOn: + items: + properties: + name: + nullable: true + type: string + selector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + type: object + nullable: true + type: array + deploymentID: + nullable: true + type: string + options: + properties: + correctDrift: + properties: + enabled: + type: boolean + force: + type: boolean + keepFailHistory: + type: boolean + type: object + defaultNamespace: + nullable: true + type: string + diff: + nullable: true + properties: + comparePatches: + items: + properties: + apiVersion: + nullable: true + type: string + jsonPointers: + items: + nullable: true + type: string + nullable: true + type: array + kind: + nullable: true + type: string + name: + nullable: true + type: string + namespace: + nullable: true + type: string + operations: + items: + properties: + op: + nullable: true + type: string + path: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + type: object + nullable: true + type: array + type: object + forceSyncGeneration: + type: integer + helm: + nullable: true + properties: + atomic: + type: boolean + chart: + nullable: true + type: string + disablePreProcess: + type: boolean + force: + type: boolean + maxHistory: + type: integer + releaseName: + maxLength: 53 + nullable: true + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + repo: + nullable: true + type: string + takeOwnership: + type: boolean + timeoutSeconds: + type: integer + values: + nullable: true + type: object + x-kubernetes-preserve-unknown-fields: true + valuesFiles: + items: + nullable: true + type: string + nullable: true + type: array + valuesFrom: + items: + properties: + configMapKeyRef: + nullable: true + properties: + key: + nullable: true + type: string + name: + nullable: true + type: string + namespace: + nullable: true + type: string + type: object + secretKeyRef: + nullable: true + properties: + key: + nullable: true + type: string + name: + nullable: true + type: string + namespace: + nullable: true + type: string + type: object + type: object + nullable: true + type: array + version: + nullable: true + type: string + waitForJobs: + type: boolean + type: object + ignore: + properties: + conditions: + items: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + nullable: true + type: array + type: object + keepResources: + type: boolean + kustomize: + nullable: true + properties: + dir: + nullable: true + type: string + type: object + namespace: + nullable: true + type: string + namespaceAnnotations: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + namespaceLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + serviceAccount: + nullable: true + type: string + yaml: + nullable: true + properties: + overlays: + items: + nullable: true + type: string + nullable: true + type: array + type: object + type: object + paused: + type: boolean + stagedDeploymentID: + nullable: true + type: string + stagedOptions: + properties: + correctDrift: + properties: + enabled: + type: boolean + force: + type: boolean + keepFailHistory: + type: boolean + type: object + defaultNamespace: + nullable: true + type: string + diff: + nullable: true + properties: + comparePatches: + items: + properties: + apiVersion: + nullable: true + type: string + jsonPointers: + items: + nullable: true + type: string + nullable: true + type: array + kind: + nullable: true + type: string + name: + nullable: true + type: string + namespace: + nullable: true + type: string + operations: + items: + properties: + op: + nullable: true + type: string + path: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + type: object + nullable: true + type: array + type: object + forceSyncGeneration: + type: integer + helm: + nullable: true + properties: + atomic: + type: boolean + chart: + nullable: true + type: string + disablePreProcess: + type: boolean + force: + type: boolean + maxHistory: + type: integer + releaseName: + nullable: true + type: string + repo: + nullable: true + type: string + takeOwnership: + type: boolean + timeoutSeconds: + type: integer + values: + nullable: true + type: object + x-kubernetes-preserve-unknown-fields: true + valuesFiles: + items: + nullable: true + type: string + nullable: true + type: array + valuesFrom: + items: + properties: + configMapKeyRef: + nullable: true + properties: + key: + nullable: true + type: string + name: + nullable: true + type: string + namespace: + nullable: true + type: string + type: object + secretKeyRef: + nullable: true + properties: + key: + nullable: true + type: string + name: + nullable: true + type: string + namespace: + nullable: true + type: string + type: object + type: object + nullable: true + type: array + version: + nullable: true + type: string + waitForJobs: + type: boolean + type: object + ignore: + properties: + conditions: + items: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + nullable: true + type: array + type: object + keepResources: + type: boolean + kustomize: + nullable: true + properties: + dir: + nullable: true + type: string + type: object + namespace: + nullable: true + type: string + namespaceAnnotations: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + namespaceLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + serviceAccount: + nullable: true + type: string + yaml: + nullable: true + properties: + overlays: + items: + nullable: true + type: string + nullable: true + type: array + type: object + type: object + type: object + status: + properties: + appliedDeploymentID: + nullable: true + type: string + conditions: + items: + properties: + lastTransitionTime: + nullable: true + type: string + lastUpdateTime: + nullable: true + type: string + message: + nullable: true + type: string + reason: + nullable: true + type: string + status: + nullable: true + type: string + type: + nullable: true + type: string + type: object + nullable: true + type: array + display: + properties: + deployed: + nullable: true + type: string + monitored: + nullable: true + type: string + state: + nullable: true + type: string + type: object + modifiedStatus: + items: + properties: + apiVersion: + nullable: true + type: string + delete: + type: boolean + kind: + nullable: true + type: string + missing: + type: boolean + name: + nullable: true + type: string + namespace: + nullable: true + type: string + patch: + nullable: true + type: string + type: object + nullable: true + type: array + nonModified: + type: boolean + nonReadyStatus: + items: + properties: + apiVersion: + nullable: true + type: string + kind: + nullable: true + type: string + name: + nullable: true + type: string + namespace: + nullable: true + type: string + summary: + properties: + error: + type: boolean + message: + items: + nullable: true + type: string + nullable: true + type: array + state: + nullable: true + type: string + transitioning: + type: boolean + type: object + uid: + nullable: true + type: string + type: object + nullable: true + type: array + ready: + type: boolean + release: + nullable: true + type: string + resources: + items: + properties: + apiVersion: + nullable: true + type: string + createdAt: + nullable: true + type: string + kind: + nullable: true + type: string + name: + nullable: true + type: string + namespace: + nullable: true + type: string + type: object + nullable: true + type: array + syncGeneration: + nullable: true + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} + +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: bundlenamespacemappings.fleet.cattle.io +spec: + group: fleet.cattle.io + names: + kind: BundleNamespaceMapping + plural: bundlenamespacemappings + singular: bundlenamespacemapping + preserveUnknownFields: false + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + properties: + bundleSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + namespaceSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + type: object + served: true + storage: true + subresources: + status: {} + +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: clustergroups.fleet.cattle.io +spec: + group: fleet.cattle.io + names: + categories: + - fleet + kind: ClusterGroup + plural: clustergroups + singular: clustergroup + preserveUnknownFields: false + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.display.readyClusters + name: Clusters-Ready + type: string + - jsonPath: .status.display.readyBundles + name: Bundles-Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + spec: + properties: + selector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + type: object + status: + properties: + clusterCount: + type: integer + conditions: + items: + properties: + lastTransitionTime: + nullable: true + type: string + lastUpdateTime: + nullable: true + type: string + message: + nullable: true + type: string + reason: + nullable: true + type: string + status: + nullable: true + type: string + type: + nullable: true + type: string + type: object + nullable: true + type: array + display: + properties: + readyBundles: + nullable: true + type: string + readyClusters: + nullable: true + type: string + state: + nullable: true + type: string + type: object + nonReadyClusterCount: + type: integer + nonReadyClusters: + items: + nullable: true + type: string + nullable: true + type: array + resourceCounts: + properties: + desiredReady: + type: integer + missing: + type: integer + modified: + type: integer + notReady: + type: integer + orphaned: + type: integer + ready: + type: integer + unknown: + type: integer + waitApplied: + type: integer + type: object + summary: + properties: + desiredReady: + type: integer + errApplied: + type: integer + modified: + type: integer + nonReadyResources: + items: + properties: + bundleState: + nullable: true + type: string + message: + nullable: true + type: string + modifiedStatus: + items: + properties: + apiVersion: + nullable: true + type: string + delete: + type: boolean + kind: + nullable: true + type: string + missing: + type: boolean + name: + nullable: true + type: string + namespace: + nullable: true + type: string + patch: + nullable: true + type: string + type: object + nullable: true + type: array + name: + nullable: true + type: string + nonReadyStatus: + items: + properties: + apiVersion: + nullable: true + type: string + kind: + nullable: true + type: string + name: + nullable: true + type: string + namespace: + nullable: true + type: string + summary: + properties: + error: + type: boolean + message: + items: + nullable: true + type: string + nullable: true + type: array + state: + nullable: true + type: string + transitioning: + type: boolean + type: object + uid: + nullable: true + type: string + type: object + nullable: true + type: array + type: object + nullable: true + type: array + notReady: + type: integer + outOfSync: + type: integer + pending: + type: integer + ready: + type: integer + waitApplied: + type: integer + type: object + type: object + type: object + served: true + storage: true + subresources: + status: {} + +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: clusters.fleet.cattle.io +spec: + group: fleet.cattle.io + names: + kind: Cluster + plural: clusters + singular: cluster + preserveUnknownFields: false + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.display.readyBundles + name: Bundles-Ready + type: string + - jsonPath: .status.display.readyNodes + name: Nodes-Ready + type: string + - jsonPath: .status.display.sampleNode + name: Sample-Node + type: string + - jsonPath: .status.agent.lastSeen + name: Last-Seen + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + metadata: + properties: + name: + maxLength: 63 + pattern: ^[-a-z0-9]+$ + type: string + type: object + spec: + properties: + agentAffinity: + nullable: true + properties: + nodeAffinity: + nullable: true + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + preference: + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + enum: + - In + - NotIn + - Exists + - DoesNotExist + - Gt + - Lt + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchFields: + items: + properties: + key: + nullable: true + type: string + operator: + enum: + - In + - NotIn + - Exists + - DoesNotExist + - Gt + - Lt + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + type: object + weight: + type: integer + type: object + nullable: true + type: array + requiredDuringSchedulingIgnoredDuringExecution: + nullable: true + properties: + nodeSelectorTerms: + items: + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + enum: + - In + - NotIn + - Exists + - DoesNotExist + - Gt + - Lt + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchFields: + items: + properties: + key: + nullable: true + type: string + operator: + enum: + - In + - NotIn + - Exists + - DoesNotExist + - Gt + - Lt + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + type: object + nullable: true + type: array + type: object + type: object + podAffinity: + nullable: true + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + enum: + - In + - NotIn + - Exists + - DoesNotExist + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + namespaceSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + enum: + - In + - NotIn + - Exists + - DoesNotExist + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + namespaces: + items: + nullable: true + type: string + nullable: true + type: array + topologyKey: + nullable: true + type: string + type: object + weight: + type: integer + type: object + nullable: true + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + enum: + - In + - NotIn + - Exists + - DoesNotExist + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + namespaceSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + enum: + - In + - NotIn + - Exists + - DoesNotExist + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + namespaces: + items: + nullable: true + type: string + nullable: true + type: array + topologyKey: + nullable: true + type: string + type: object + nullable: true + type: array + type: object + podAntiAffinity: + nullable: true + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + enum: + - In + - NotIn + - Exists + - DoesNotExist + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + namespaceSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + enum: + - In + - NotIn + - Exists + - DoesNotExist + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + namespaces: + items: + nullable: true + type: string + nullable: true + type: array + topologyKey: + nullable: true + type: string + type: object + weight: + type: integer + type: object + nullable: true + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + enum: + - In + - NotIn + - Exists + - DoesNotExist + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + namespaceSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + enum: + - In + - NotIn + - Exists + - DoesNotExist + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + namespaces: + items: + nullable: true + type: string + nullable: true + type: array + topologyKey: + nullable: true + type: string + type: object + nullable: true + type: array + type: object + type: object + agentEnvVars: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + valueFrom: + nullable: true + properties: + configMapKeyRef: + nullable: true + properties: + key: + nullable: true + type: string + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + fieldRef: + nullable: true + properties: + apiVersion: + nullable: true + type: string + fieldPath: + nullable: true + type: string + type: object + resourceFieldRef: + nullable: true + properties: + containerName: + nullable: true + type: string + divisor: + nullable: true + type: string + resource: + nullable: true + type: string + type: object + secretKeyRef: + nullable: true + properties: + key: + nullable: true + type: string + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + type: object + type: object + nullable: true + type: array + agentNamespace: + nullable: true + type: string + agentResources: + nullable: true + properties: + limits: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + requests: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + agentTolerations: + items: + properties: + effect: + nullable: true + type: string + key: + nullable: true + type: string + operator: + nullable: true + type: string + tolerationSeconds: + maximum: 86400 + nullable: true + type: integer + value: + nullable: true + type: string + type: object + nullable: true + type: array + clientID: + nullable: true + type: string + kubeConfigSecret: + nullable: true + type: string + paused: + type: boolean + privateRepoURL: + nullable: true + type: string + redeployAgentGeneration: + type: integer + templateValues: + nullable: true + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + status: + properties: + agent: + properties: + lastSeen: + nullable: true + type: string + namespace: + nullable: true + type: string + nonReadyNodeNames: + items: + nullable: true + type: string + nullable: true + type: array + nonReadyNodes: + type: integer + readyNodeNames: + items: + nullable: true + type: string + nullable: true + type: array + readyNodes: + type: integer + type: object + agentAffinityHash: + nullable: true + type: string + agentConfigChanged: + type: boolean + agentDeployedGeneration: + nullable: true + type: integer + agentEnvVarsHash: + nullable: true + type: string + agentMigrated: + type: boolean + agentNamespaceMigrated: + type: boolean + agentPrivateRepoURL: + nullable: true + type: string + agentResourcesHash: + nullable: true + type: string + agentTolerationsHash: + nullable: true + type: string + apiServerCAHash: + nullable: true + type: string + apiServerURL: + nullable: true + type: string + cattleNamespaceMigrated: + type: boolean + conditions: + items: + properties: + lastTransitionTime: + nullable: true + type: string + lastUpdateTime: + nullable: true + type: string + message: + nullable: true + type: string + reason: + nullable: true + type: string + status: + nullable: true + type: string + type: + nullable: true + type: string + type: object + nullable: true + type: array + desiredReadyGitRepos: + type: integer + display: + properties: + readyBundles: + nullable: true + type: string + readyNodes: + nullable: true + type: string + sampleNode: + nullable: true + type: string + state: + nullable: true + type: string + type: object + namespace: + nullable: true + type: string + readyGitRepos: + type: integer + resourceCounts: + properties: + desiredReady: + type: integer + missing: + type: integer + modified: + type: integer + notReady: + type: integer + orphaned: + type: integer + ready: + type: integer + unknown: + type: integer + waitApplied: + type: integer + type: object + summary: + properties: + desiredReady: + type: integer + errApplied: + type: integer + modified: + type: integer + nonReadyResources: + items: + properties: + bundleState: + nullable: true + type: string + message: + nullable: true + type: string + modifiedStatus: + items: + properties: + apiVersion: + nullable: true + type: string + delete: + type: boolean + kind: + nullable: true + type: string + missing: + type: boolean + name: + nullable: true + type: string + namespace: + nullable: true + type: string + patch: + nullable: true + type: string + type: object + nullable: true + type: array + name: + nullable: true + type: string + nonReadyStatus: + items: + properties: + apiVersion: + nullable: true + type: string + kind: + nullable: true + type: string + name: + nullable: true + type: string + namespace: + nullable: true + type: string + summary: + properties: + error: + type: boolean + message: + items: + nullable: true + type: string + nullable: true + type: array + state: + nullable: true + type: string + transitioning: + type: boolean + type: object + uid: + nullable: true + type: string + type: object + nullable: true + type: array + type: object + nullable: true + type: array + notReady: + type: integer + outOfSync: + type: integer + pending: + type: integer + ready: + type: integer + waitApplied: + type: integer + type: object + type: object + type: object + served: true + storage: true + subresources: + status: {} + +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: clusterregistrationtokens.fleet.cattle.io +spec: + group: fleet.cattle.io + names: + kind: ClusterRegistrationToken + plural: clusterregistrationtokens + singular: clusterregistrationtoken + preserveUnknownFields: false + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.secretName + name: Secret-Name + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + metadata: + properties: + name: + maxLength: 63 + pattern: ^[-a-z0-9]+$ + type: string + type: object + spec: + properties: + ttl: + nullable: true + type: string + type: object + status: + properties: + expires: + nullable: true + type: string + secretName: + nullable: true + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} + +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: gitrepos.fleet.cattle.io +spec: + group: fleet.cattle.io + names: + categories: + - fleet + kind: GitRepo + plural: gitrepos + singular: gitrepo + preserveUnknownFields: false + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.repo + name: Repo + type: string + - jsonPath: .status.commit + name: Commit + type: string + - jsonPath: .status.display.readyBundleDeployments + name: BundleDeployments-Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + spec: + properties: + branch: + nullable: true + type: string + caBundle: + nullable: true + type: string + clientSecretName: + nullable: true + type: string + correctDrift: + properties: + enabled: + type: boolean + force: + type: boolean + keepFailHistory: + type: boolean + type: object + forceSyncGeneration: + type: integer + helmRepoURLRegex: + nullable: true + type: string + helmSecretName: + nullable: true + type: string + helmSecretNameForPaths: + nullable: true + type: string + imageScanCommit: + properties: + authorEmail: + nullable: true + type: string + authorName: + nullable: true + type: string + messageTemplate: + nullable: true + type: string + type: object + imageScanInterval: + nullable: true + type: string + insecureSkipTLSVerify: + type: boolean + keepResources: + type: boolean + paths: + items: + nullable: true + type: string + nullable: true + type: array + paused: + type: boolean + pollingInterval: + nullable: true + type: string + repo: + nullable: true + type: string + revision: + nullable: true + type: string + serviceAccount: + nullable: true + type: string + targetNamespace: + nullable: true + type: string + targets: + items: + properties: + clusterGroup: + nullable: true + type: string + clusterGroupSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + clusterName: + nullable: true + type: string + clusterSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + name: + nullable: true + type: string + type: object + nullable: true + type: array + type: object + status: + properties: + commit: + nullable: true + type: string + conditions: + items: + properties: + lastTransitionTime: + nullable: true + type: string + lastUpdateTime: + nullable: true + type: string + message: + nullable: true + type: string + reason: + nullable: true + type: string + status: + nullable: true + type: string + type: + nullable: true + type: string + type: object + nullable: true + type: array + desiredReadyClusters: + type: integer + display: + properties: + error: + type: boolean + message: + nullable: true + type: string + readyBundleDeployments: + nullable: true + type: string + state: + nullable: true + type: string + type: object + gitJobStatus: + nullable: true + type: string + lastSyncedImageScanTime: + nullable: true + type: string + observedGeneration: + type: integer + readyClusters: + type: integer + resourceCounts: + properties: + desiredReady: + type: integer + missing: + type: integer + modified: + type: integer + notReady: + type: integer + orphaned: + type: integer + ready: + type: integer + unknown: + type: integer + waitApplied: + type: integer + type: object + resourceErrors: + items: + nullable: true + type: string + nullable: true + type: array + resources: + items: + properties: + apiVersion: + nullable: true + type: string + error: + type: boolean + id: + nullable: true + type: string + incompleteState: + type: boolean + kind: + nullable: true + type: string + message: + nullable: true + type: string + name: + nullable: true + type: string + namespace: + nullable: true + type: string + perClusterState: + items: + properties: + clusterId: + nullable: true + type: string + error: + type: boolean + message: + nullable: true + type: string + patch: + nullable: true + type: object + x-kubernetes-preserve-unknown-fields: true + state: + nullable: true + type: string + transitioning: + type: boolean + type: object + nullable: true + type: array + state: + nullable: true + type: string + transitioning: + type: boolean + type: + nullable: true + type: string + type: object + nullable: true + type: array + summary: + properties: + desiredReady: + type: integer + errApplied: + type: integer + modified: + type: integer + nonReadyResources: + items: + properties: + bundleState: + nullable: true + type: string + message: + nullable: true + type: string + modifiedStatus: + items: + properties: + apiVersion: + nullable: true + type: string + delete: + type: boolean + kind: + nullable: true + type: string + missing: + type: boolean + name: + nullable: true + type: string + namespace: + nullable: true + type: string + patch: + nullable: true + type: string + type: object + nullable: true + type: array + name: + nullable: true + type: string + nonReadyStatus: + items: + properties: + apiVersion: + nullable: true + type: string + kind: + nullable: true + type: string + name: + nullable: true + type: string + namespace: + nullable: true + type: string + summary: + properties: + error: + type: boolean + message: + items: + nullable: true + type: string + nullable: true + type: array + state: + nullable: true + type: string + transitioning: + type: boolean + type: object + uid: + nullable: true + type: string + type: object + nullable: true + type: array + type: object + nullable: true + type: array + notReady: + type: integer + outOfSync: + type: integer + pending: + type: integer + ready: + type: integer + waitApplied: + type: integer + type: object + type: object + type: object + served: true + storage: true + subresources: + status: {} + +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: clusterregistrations.fleet.cattle.io +spec: + group: fleet.cattle.io + names: + kind: ClusterRegistration + plural: clusterregistrations + singular: clusterregistration + preserveUnknownFields: false + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.clusterName + name: Cluster-Name + type: string + - jsonPath: .spec.clusterLabels + name: Labels + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + spec: + properties: + clientID: + nullable: true + type: string + clientRandom: + nullable: true + type: string + clusterLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + status: + properties: + clusterName: + nullable: true + type: string + granted: + type: boolean + type: object + type: object + served: true + storage: true + subresources: + status: {} + +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: gitreporestrictions.fleet.cattle.io +spec: + group: fleet.cattle.io + names: + kind: GitRepoRestriction + plural: gitreporestrictions + singular: gitreporestriction + preserveUnknownFields: false + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .defaultServiceAccount + name: Default-ServiceAccount + type: string + - jsonPath: .allowedServiceAccounts + name: Allowed-ServiceAccounts + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + allowedClientSecretNames: + items: + nullable: true + type: string + nullable: true + type: array + allowedRepoPatterns: + items: + nullable: true + type: string + nullable: true + type: array + allowedServiceAccounts: + items: + nullable: true + type: string + nullable: true + type: array + allowedTargetNamespaces: + items: + nullable: true + type: string + nullable: true + type: array + defaultClientSecretName: + nullable: true + type: string + defaultServiceAccount: + nullable: true + type: string + type: object + served: true + storage: true + subresources: + status: {} + +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: contents.fleet.cattle.io +spec: + group: fleet.cattle.io + names: + kind: Content + plural: contents + singular: content + preserveUnknownFields: false + scope: Cluster + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + properties: + content: + nullable: true + type: string + type: object + served: true + storage: true + +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: imagescans.fleet.cattle.io +spec: + group: fleet.cattle.io + names: + categories: + - fleet + kind: ImageScan + plural: imagescans + singular: imagescan + preserveUnknownFields: false + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.image + name: Repository + type: string + - jsonPath: .status.latestTag + name: Latest + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + spec: + properties: + gitrepoName: + nullable: true + type: string + image: + nullable: true + type: string + interval: + nullable: true + type: string + policy: + properties: + alphabetical: + nullable: true + properties: + order: + nullable: true + type: string + type: object + semver: + nullable: true + properties: + range: + nullable: true + type: string + type: object + type: object + secretRef: + nullable: true + properties: + name: + nullable: true + type: string + type: object + suspend: + type: boolean + tagName: + nullable: true + type: string + type: object + status: + properties: + canonicalImageName: + nullable: true + type: string + conditions: + items: + properties: + lastTransitionTime: + nullable: true + type: string + lastUpdateTime: + nullable: true + type: string + message: + nullable: true + type: string + reason: + nullable: true + type: string + status: + nullable: true + type: string + type: + nullable: true + type: string + type: object + nullable: true + type: array + lastScanTime: + nullable: true + type: string + latestDigest: + nullable: true + type: string + latestImage: + nullable: true + type: string + latestTag: + nullable: true + type: string + observedGeneration: + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/charts/fleet-crd/102.2.0+up0.8.0/templates/gitjobs-crds.yaml b/charts/fleet-crd/102.2.0+up0.8.0/templates/gitjobs-crds.yaml new file mode 100644 index 000000000..d6c36cb7b --- /dev/null +++ b/charts/fleet-crd/102.2.0+up0.8.0/templates/gitjobs-crds.yaml @@ -0,0 +1,7510 @@ +{{- if .Capabilities.APIVersions.Has "apiextensions.k8s.io/v1" -}} +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: gitjobs.gitjob.cattle.io +spec: + group: gitjob.cattle.io + names: + kind: GitJob + plural: gitjobs + singular: gitjob + preserveUnknownFields: false + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.git.repo + name: REPO + type: string + - jsonPath: .spec.git.branch + name: BRANCH + type: string + - jsonPath: .status.commit + name: COMMIT + type: string + - jsonPath: .status.jobStatus + name: JOBSTATUS + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + properties: + spec: + properties: + forceUpdateGeneration: + type: integer + git: + properties: + branch: + nullable: true + type: string + caBundle: + nullable: true + type: string + clientSecretName: + nullable: true + type: string + insecureSkipTLSVerify: + type: boolean + onTag: + nullable: true + type: string + provider: + nullable: true + type: string + repo: + nullable: true + type: string + revision: + nullable: true + type: string + type: object + jobSpec: + properties: + activeDeadlineSeconds: + nullable: true + type: integer + backoffLimit: + nullable: true + type: integer + completionMode: + nullable: true + type: string + completions: + nullable: true + type: integer + manualSelector: + nullable: true + type: boolean + parallelism: + nullable: true + type: integer + podFailurePolicy: + nullable: true + properties: + rules: + items: + properties: + action: + nullable: true + type: string + onExitCodes: + nullable: true + properties: + containerName: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + type: integer + nullable: true + type: array + type: object + onPodConditions: + items: + properties: + status: + nullable: true + type: string + type: + nullable: true + type: string + type: object + nullable: true + type: array + type: object + nullable: true + type: array + type: object + selector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + suspend: + nullable: true + type: boolean + template: + properties: + metadata: + properties: + annotations: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + creationTimestamp: + nullable: true + type: string + deletionGracePeriodSeconds: + nullable: true + type: integer + deletionTimestamp: + nullable: true + type: string + finalizers: + items: + nullable: true + type: string + nullable: true + type: array + generateName: + nullable: true + type: string + generation: + type: integer + labels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + managedFields: + items: + properties: + apiVersion: + nullable: true + type: string + fieldsType: + nullable: true + type: string + fieldsV1: + nullable: true + type: object + manager: + nullable: true + type: string + operation: + nullable: true + type: string + subresource: + nullable: true + type: string + time: + nullable: true + type: string + type: object + nullable: true + type: array + name: + nullable: true + type: string + namespace: + nullable: true + type: string + ownerReferences: + items: + properties: + apiVersion: + nullable: true + type: string + blockOwnerDeletion: + nullable: true + type: boolean + controller: + nullable: true + type: boolean + kind: + nullable: true + type: string + name: + nullable: true + type: string + uid: + nullable: true + type: string + type: object + nullable: true + type: array + resourceVersion: + nullable: true + type: string + selfLink: + nullable: true + type: string + uid: + nullable: true + type: string + type: object + spec: + properties: + activeDeadlineSeconds: + nullable: true + type: integer + affinity: + nullable: true + properties: + nodeAffinity: + nullable: true + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + preference: + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchFields: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + type: object + weight: + type: integer + type: object + nullable: true + type: array + requiredDuringSchedulingIgnoredDuringExecution: + nullable: true + properties: + nodeSelectorTerms: + items: + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchFields: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + type: object + nullable: true + type: array + type: object + type: object + podAffinity: + nullable: true + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + namespaceSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + namespaces: + items: + nullable: true + type: string + nullable: true + type: array + topologyKey: + nullable: true + type: string + type: object + weight: + type: integer + type: object + nullable: true + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + namespaceSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + namespaces: + items: + nullable: true + type: string + nullable: true + type: array + topologyKey: + nullable: true + type: string + type: object + nullable: true + type: array + type: object + podAntiAffinity: + nullable: true + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + namespaceSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + namespaces: + items: + nullable: true + type: string + nullable: true + type: array + topologyKey: + nullable: true + type: string + type: object + weight: + type: integer + type: object + nullable: true + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + namespaceSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + namespaces: + items: + nullable: true + type: string + nullable: true + type: array + topologyKey: + nullable: true + type: string + type: object + nullable: true + type: array + type: object + type: object + automountServiceAccountToken: + nullable: true + type: boolean + containers: + items: + properties: + args: + items: + nullable: true + type: string + nullable: true + type: array + command: + items: + nullable: true + type: string + nullable: true + type: array + env: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + valueFrom: + nullable: true + properties: + configMapKeyRef: + nullable: true + properties: + key: + nullable: true + type: string + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + fieldRef: + nullable: true + properties: + apiVersion: + nullable: true + type: string + fieldPath: + nullable: true + type: string + type: object + resourceFieldRef: + nullable: true + properties: + containerName: + nullable: true + type: string + divisor: + nullable: true + type: string + resource: + nullable: true + type: string + type: object + secretKeyRef: + nullable: true + properties: + key: + nullable: true + type: string + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + type: object + type: object + nullable: true + type: array + envFrom: + items: + properties: + configMapRef: + nullable: true + properties: + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + prefix: + nullable: true + type: string + secretRef: + nullable: true + properties: + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + type: object + nullable: true + type: array + image: + nullable: true + type: string + imagePullPolicy: + nullable: true + type: string + lifecycle: + nullable: true + properties: + postStart: + nullable: true + properties: + exec: + nullable: true + properties: + command: + items: + nullable: true + type: string + nullable: true + type: array + type: object + httpGet: + nullable: true + properties: + host: + nullable: true + type: string + httpHeaders: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + path: + nullable: true + type: string + port: + nullable: true + type: string + scheme: + nullable: true + type: string + type: object + tcpSocket: + nullable: true + properties: + host: + nullable: true + type: string + port: + nullable: true + type: string + type: object + type: object + preStop: + nullable: true + properties: + exec: + nullable: true + properties: + command: + items: + nullable: true + type: string + nullable: true + type: array + type: object + httpGet: + nullable: true + properties: + host: + nullable: true + type: string + httpHeaders: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + path: + nullable: true + type: string + port: + nullable: true + type: string + scheme: + nullable: true + type: string + type: object + tcpSocket: + nullable: true + properties: + host: + nullable: true + type: string + port: + nullable: true + type: string + type: object + type: object + type: object + livenessProbe: + nullable: true + properties: + exec: + nullable: true + properties: + command: + items: + nullable: true + type: string + nullable: true + type: array + type: object + failureThreshold: + type: integer + grpc: + nullable: true + properties: + port: + type: integer + service: + nullable: true + type: string + type: object + httpGet: + nullable: true + properties: + host: + nullable: true + type: string + httpHeaders: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + path: + nullable: true + type: string + port: + nullable: true + type: string + scheme: + nullable: true + type: string + type: object + initialDelaySeconds: + type: integer + periodSeconds: + type: integer + successThreshold: + type: integer + tcpSocket: + nullable: true + properties: + host: + nullable: true + type: string + port: + nullable: true + type: string + type: object + terminationGracePeriodSeconds: + nullable: true + type: integer + timeoutSeconds: + type: integer + type: object + name: + nullable: true + type: string + ports: + items: + properties: + containerPort: + type: integer + hostIP: + nullable: true + type: string + hostPort: + type: integer + name: + nullable: true + type: string + protocol: + nullable: true + type: string + type: object + nullable: true + type: array + readinessProbe: + nullable: true + properties: + exec: + nullable: true + properties: + command: + items: + nullable: true + type: string + nullable: true + type: array + type: object + failureThreshold: + type: integer + grpc: + nullable: true + properties: + port: + type: integer + service: + nullable: true + type: string + type: object + httpGet: + nullable: true + properties: + host: + nullable: true + type: string + httpHeaders: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + path: + nullable: true + type: string + port: + nullable: true + type: string + scheme: + nullable: true + type: string + type: object + initialDelaySeconds: + type: integer + periodSeconds: + type: integer + successThreshold: + type: integer + tcpSocket: + nullable: true + properties: + host: + nullable: true + type: string + port: + nullable: true + type: string + type: object + terminationGracePeriodSeconds: + nullable: true + type: integer + timeoutSeconds: + type: integer + type: object + resources: + properties: + limits: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + requests: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + securityContext: + nullable: true + properties: + allowPrivilegeEscalation: + nullable: true + type: boolean + capabilities: + nullable: true + properties: + add: + items: + nullable: true + type: string + nullable: true + type: array + drop: + items: + nullable: true + type: string + nullable: true + type: array + type: object + privileged: + nullable: true + type: boolean + procMount: + nullable: true + type: string + readOnlyRootFilesystem: + nullable: true + type: boolean + runAsGroup: + nullable: true + type: integer + runAsNonRoot: + nullable: true + type: boolean + runAsUser: + nullable: true + type: integer + seLinuxOptions: + nullable: true + properties: + level: + nullable: true + type: string + role: + nullable: true + type: string + type: + nullable: true + type: string + user: + nullable: true + type: string + type: object + seccompProfile: + nullable: true + properties: + localhostProfile: + nullable: true + type: string + type: + nullable: true + type: string + type: object + windowsOptions: + nullable: true + properties: + gmsaCredentialSpec: + nullable: true + type: string + gmsaCredentialSpecName: + nullable: true + type: string + hostProcess: + nullable: true + type: boolean + runAsUserName: + nullable: true + type: string + type: object + type: object + startupProbe: + nullable: true + properties: + exec: + nullable: true + properties: + command: + items: + nullable: true + type: string + nullable: true + type: array + type: object + failureThreshold: + type: integer + grpc: + nullable: true + properties: + port: + type: integer + service: + nullable: true + type: string + type: object + httpGet: + nullable: true + properties: + host: + nullable: true + type: string + httpHeaders: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + path: + nullable: true + type: string + port: + nullable: true + type: string + scheme: + nullable: true + type: string + type: object + initialDelaySeconds: + type: integer + periodSeconds: + type: integer + successThreshold: + type: integer + tcpSocket: + nullable: true + properties: + host: + nullable: true + type: string + port: + nullable: true + type: string + type: object + terminationGracePeriodSeconds: + nullable: true + type: integer + timeoutSeconds: + type: integer + type: object + stdin: + type: boolean + stdinOnce: + type: boolean + terminationMessagePath: + nullable: true + type: string + terminationMessagePolicy: + nullable: true + type: string + tty: + type: boolean + volumeDevices: + items: + properties: + devicePath: + nullable: true + type: string + name: + nullable: true + type: string + type: object + nullable: true + type: array + volumeMounts: + items: + properties: + mountPath: + nullable: true + type: string + mountPropagation: + nullable: true + type: string + name: + nullable: true + type: string + readOnly: + type: boolean + subPath: + nullable: true + type: string + subPathExpr: + nullable: true + type: string + type: object + nullable: true + type: array + workingDir: + nullable: true + type: string + type: object + nullable: true + type: array + dnsConfig: + nullable: true + properties: + nameservers: + items: + nullable: true + type: string + nullable: true + type: array + options: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + searches: + items: + nullable: true + type: string + nullable: true + type: array + type: object + dnsPolicy: + nullable: true + type: string + enableServiceLinks: + nullable: true + type: boolean + ephemeralContainers: + items: + properties: + args: + items: + nullable: true + type: string + nullable: true + type: array + command: + items: + nullable: true + type: string + nullable: true + type: array + env: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + valueFrom: + nullable: true + properties: + configMapKeyRef: + nullable: true + properties: + key: + nullable: true + type: string + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + fieldRef: + nullable: true + properties: + apiVersion: + nullable: true + type: string + fieldPath: + nullable: true + type: string + type: object + resourceFieldRef: + nullable: true + properties: + containerName: + nullable: true + type: string + divisor: + nullable: true + type: string + resource: + nullable: true + type: string + type: object + secretKeyRef: + nullable: true + properties: + key: + nullable: true + type: string + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + type: object + type: object + nullable: true + type: array + envFrom: + items: + properties: + configMapRef: + nullable: true + properties: + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + prefix: + nullable: true + type: string + secretRef: + nullable: true + properties: + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + type: object + nullable: true + type: array + image: + nullable: true + type: string + imagePullPolicy: + nullable: true + type: string + lifecycle: + nullable: true + properties: + postStart: + nullable: true + properties: + exec: + nullable: true + properties: + command: + items: + nullable: true + type: string + nullable: true + type: array + type: object + httpGet: + nullable: true + properties: + host: + nullable: true + type: string + httpHeaders: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + path: + nullable: true + type: string + port: + nullable: true + type: string + scheme: + nullable: true + type: string + type: object + tcpSocket: + nullable: true + properties: + host: + nullable: true + type: string + port: + nullable: true + type: string + type: object + type: object + preStop: + nullable: true + properties: + exec: + nullable: true + properties: + command: + items: + nullable: true + type: string + nullable: true + type: array + type: object + httpGet: + nullable: true + properties: + host: + nullable: true + type: string + httpHeaders: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + path: + nullable: true + type: string + port: + nullable: true + type: string + scheme: + nullable: true + type: string + type: object + tcpSocket: + nullable: true + properties: + host: + nullable: true + type: string + port: + nullable: true + type: string + type: object + type: object + type: object + livenessProbe: + nullable: true + properties: + exec: + nullable: true + properties: + command: + items: + nullable: true + type: string + nullable: true + type: array + type: object + failureThreshold: + type: integer + grpc: + nullable: true + properties: + port: + type: integer + service: + nullable: true + type: string + type: object + httpGet: + nullable: true + properties: + host: + nullable: true + type: string + httpHeaders: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + path: + nullable: true + type: string + port: + nullable: true + type: string + scheme: + nullable: true + type: string + type: object + initialDelaySeconds: + type: integer + periodSeconds: + type: integer + successThreshold: + type: integer + tcpSocket: + nullable: true + properties: + host: + nullable: true + type: string + port: + nullable: true + type: string + type: object + terminationGracePeriodSeconds: + nullable: true + type: integer + timeoutSeconds: + type: integer + type: object + name: + nullable: true + type: string + ports: + items: + properties: + containerPort: + type: integer + hostIP: + nullable: true + type: string + hostPort: + type: integer + name: + nullable: true + type: string + protocol: + nullable: true + type: string + type: object + nullable: true + type: array + readinessProbe: + nullable: true + properties: + exec: + nullable: true + properties: + command: + items: + nullable: true + type: string + nullable: true + type: array + type: object + failureThreshold: + type: integer + grpc: + nullable: true + properties: + port: + type: integer + service: + nullable: true + type: string + type: object + httpGet: + nullable: true + properties: + host: + nullable: true + type: string + httpHeaders: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + path: + nullable: true + type: string + port: + nullable: true + type: string + scheme: + nullable: true + type: string + type: object + initialDelaySeconds: + type: integer + periodSeconds: + type: integer + successThreshold: + type: integer + tcpSocket: + nullable: true + properties: + host: + nullable: true + type: string + port: + nullable: true + type: string + type: object + terminationGracePeriodSeconds: + nullable: true + type: integer + timeoutSeconds: + type: integer + type: object + resources: + properties: + limits: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + requests: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + securityContext: + nullable: true + properties: + allowPrivilegeEscalation: + nullable: true + type: boolean + capabilities: + nullable: true + properties: + add: + items: + nullable: true + type: string + nullable: true + type: array + drop: + items: + nullable: true + type: string + nullable: true + type: array + type: object + privileged: + nullable: true + type: boolean + procMount: + nullable: true + type: string + readOnlyRootFilesystem: + nullable: true + type: boolean + runAsGroup: + nullable: true + type: integer + runAsNonRoot: + nullable: true + type: boolean + runAsUser: + nullable: true + type: integer + seLinuxOptions: + nullable: true + properties: + level: + nullable: true + type: string + role: + nullable: true + type: string + type: + nullable: true + type: string + user: + nullable: true + type: string + type: object + seccompProfile: + nullable: true + properties: + localhostProfile: + nullable: true + type: string + type: + nullable: true + type: string + type: object + windowsOptions: + nullable: true + properties: + gmsaCredentialSpec: + nullable: true + type: string + gmsaCredentialSpecName: + nullable: true + type: string + hostProcess: + nullable: true + type: boolean + runAsUserName: + nullable: true + type: string + type: object + type: object + startupProbe: + nullable: true + properties: + exec: + nullable: true + properties: + command: + items: + nullable: true + type: string + nullable: true + type: array + type: object + failureThreshold: + type: integer + grpc: + nullable: true + properties: + port: + type: integer + service: + nullable: true + type: string + type: object + httpGet: + nullable: true + properties: + host: + nullable: true + type: string + httpHeaders: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + path: + nullable: true + type: string + port: + nullable: true + type: string + scheme: + nullable: true + type: string + type: object + initialDelaySeconds: + type: integer + periodSeconds: + type: integer + successThreshold: + type: integer + tcpSocket: + nullable: true + properties: + host: + nullable: true + type: string + port: + nullable: true + type: string + type: object + terminationGracePeriodSeconds: + nullable: true + type: integer + timeoutSeconds: + type: integer + type: object + stdin: + type: boolean + stdinOnce: + type: boolean + targetContainerName: + nullable: true + type: string + terminationMessagePath: + nullable: true + type: string + terminationMessagePolicy: + nullable: true + type: string + tty: + type: boolean + volumeDevices: + items: + properties: + devicePath: + nullable: true + type: string + name: + nullable: true + type: string + type: object + nullable: true + type: array + volumeMounts: + items: + properties: + mountPath: + nullable: true + type: string + mountPropagation: + nullable: true + type: string + name: + nullable: true + type: string + readOnly: + type: boolean + subPath: + nullable: true + type: string + subPathExpr: + nullable: true + type: string + type: object + nullable: true + type: array + workingDir: + nullable: true + type: string + type: object + nullable: true + type: array + hostAliases: + items: + properties: + hostnames: + items: + nullable: true + type: string + nullable: true + type: array + ip: + nullable: true + type: string + type: object + nullable: true + type: array + hostIPC: + type: boolean + hostNetwork: + type: boolean + hostPID: + type: boolean + hostUsers: + nullable: true + type: boolean + hostname: + nullable: true + type: string + imagePullSecrets: + items: + properties: + name: + nullable: true + type: string + type: object + nullable: true + type: array + initContainers: + items: + properties: + args: + items: + nullable: true + type: string + nullable: true + type: array + command: + items: + nullable: true + type: string + nullable: true + type: array + env: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + valueFrom: + nullable: true + properties: + configMapKeyRef: + nullable: true + properties: + key: + nullable: true + type: string + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + fieldRef: + nullable: true + properties: + apiVersion: + nullable: true + type: string + fieldPath: + nullable: true + type: string + type: object + resourceFieldRef: + nullable: true + properties: + containerName: + nullable: true + type: string + divisor: + nullable: true + type: string + resource: + nullable: true + type: string + type: object + secretKeyRef: + nullable: true + properties: + key: + nullable: true + type: string + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + type: object + type: object + nullable: true + type: array + envFrom: + items: + properties: + configMapRef: + nullable: true + properties: + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + prefix: + nullable: true + type: string + secretRef: + nullable: true + properties: + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + type: object + nullable: true + type: array + image: + nullable: true + type: string + imagePullPolicy: + nullable: true + type: string + lifecycle: + nullable: true + properties: + postStart: + nullable: true + properties: + exec: + nullable: true + properties: + command: + items: + nullable: true + type: string + nullable: true + type: array + type: object + httpGet: + nullable: true + properties: + host: + nullable: true + type: string + httpHeaders: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + path: + nullable: true + type: string + port: + nullable: true + type: string + scheme: + nullable: true + type: string + type: object + tcpSocket: + nullable: true + properties: + host: + nullable: true + type: string + port: + nullable: true + type: string + type: object + type: object + preStop: + nullable: true + properties: + exec: + nullable: true + properties: + command: + items: + nullable: true + type: string + nullable: true + type: array + type: object + httpGet: + nullable: true + properties: + host: + nullable: true + type: string + httpHeaders: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + path: + nullable: true + type: string + port: + nullable: true + type: string + scheme: + nullable: true + type: string + type: object + tcpSocket: + nullable: true + properties: + host: + nullable: true + type: string + port: + nullable: true + type: string + type: object + type: object + type: object + livenessProbe: + nullable: true + properties: + exec: + nullable: true + properties: + command: + items: + nullable: true + type: string + nullable: true + type: array + type: object + failureThreshold: + type: integer + grpc: + nullable: true + properties: + port: + type: integer + service: + nullable: true + type: string + type: object + httpGet: + nullable: true + properties: + host: + nullable: true + type: string + httpHeaders: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + path: + nullable: true + type: string + port: + nullable: true + type: string + scheme: + nullable: true + type: string + type: object + initialDelaySeconds: + type: integer + periodSeconds: + type: integer + successThreshold: + type: integer + tcpSocket: + nullable: true + properties: + host: + nullable: true + type: string + port: + nullable: true + type: string + type: object + terminationGracePeriodSeconds: + nullable: true + type: integer + timeoutSeconds: + type: integer + type: object + name: + nullable: true + type: string + ports: + items: + properties: + containerPort: + type: integer + hostIP: + nullable: true + type: string + hostPort: + type: integer + name: + nullable: true + type: string + protocol: + nullable: true + type: string + type: object + nullable: true + type: array + readinessProbe: + nullable: true + properties: + exec: + nullable: true + properties: + command: + items: + nullable: true + type: string + nullable: true + type: array + type: object + failureThreshold: + type: integer + grpc: + nullable: true + properties: + port: + type: integer + service: + nullable: true + type: string + type: object + httpGet: + nullable: true + properties: + host: + nullable: true + type: string + httpHeaders: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + path: + nullable: true + type: string + port: + nullable: true + type: string + scheme: + nullable: true + type: string + type: object + initialDelaySeconds: + type: integer + periodSeconds: + type: integer + successThreshold: + type: integer + tcpSocket: + nullable: true + properties: + host: + nullable: true + type: string + port: + nullable: true + type: string + type: object + terminationGracePeriodSeconds: + nullable: true + type: integer + timeoutSeconds: + type: integer + type: object + resources: + properties: + limits: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + requests: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + securityContext: + nullable: true + properties: + allowPrivilegeEscalation: + nullable: true + type: boolean + capabilities: + nullable: true + properties: + add: + items: + nullable: true + type: string + nullable: true + type: array + drop: + items: + nullable: true + type: string + nullable: true + type: array + type: object + privileged: + nullable: true + type: boolean + procMount: + nullable: true + type: string + readOnlyRootFilesystem: + nullable: true + type: boolean + runAsGroup: + nullable: true + type: integer + runAsNonRoot: + nullable: true + type: boolean + runAsUser: + nullable: true + type: integer + seLinuxOptions: + nullable: true + properties: + level: + nullable: true + type: string + role: + nullable: true + type: string + type: + nullable: true + type: string + user: + nullable: true + type: string + type: object + seccompProfile: + nullable: true + properties: + localhostProfile: + nullable: true + type: string + type: + nullable: true + type: string + type: object + windowsOptions: + nullable: true + properties: + gmsaCredentialSpec: + nullable: true + type: string + gmsaCredentialSpecName: + nullable: true + type: string + hostProcess: + nullable: true + type: boolean + runAsUserName: + nullable: true + type: string + type: object + type: object + startupProbe: + nullable: true + properties: + exec: + nullable: true + properties: + command: + items: + nullable: true + type: string + nullable: true + type: array + type: object + failureThreshold: + type: integer + grpc: + nullable: true + properties: + port: + type: integer + service: + nullable: true + type: string + type: object + httpGet: + nullable: true + properties: + host: + nullable: true + type: string + httpHeaders: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + path: + nullable: true + type: string + port: + nullable: true + type: string + scheme: + nullable: true + type: string + type: object + initialDelaySeconds: + type: integer + periodSeconds: + type: integer + successThreshold: + type: integer + tcpSocket: + nullable: true + properties: + host: + nullable: true + type: string + port: + nullable: true + type: string + type: object + terminationGracePeriodSeconds: + nullable: true + type: integer + timeoutSeconds: + type: integer + type: object + stdin: + type: boolean + stdinOnce: + type: boolean + terminationMessagePath: + nullable: true + type: string + terminationMessagePolicy: + nullable: true + type: string + tty: + type: boolean + volumeDevices: + items: + properties: + devicePath: + nullable: true + type: string + name: + nullable: true + type: string + type: object + nullable: true + type: array + volumeMounts: + items: + properties: + mountPath: + nullable: true + type: string + mountPropagation: + nullable: true + type: string + name: + nullable: true + type: string + readOnly: + type: boolean + subPath: + nullable: true + type: string + subPathExpr: + nullable: true + type: string + type: object + nullable: true + type: array + workingDir: + nullable: true + type: string + type: object + nullable: true + type: array + nodeName: + nullable: true + type: string + nodeSelector: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + os: + nullable: true + properties: + name: + nullable: true + type: string + type: object + overhead: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + preemptionPolicy: + nullable: true + type: string + priority: + nullable: true + type: integer + priorityClassName: + nullable: true + type: string + readinessGates: + items: + properties: + conditionType: + nullable: true + type: string + type: object + nullable: true + type: array + restartPolicy: + nullable: true + type: string + runtimeClassName: + nullable: true + type: string + schedulerName: + nullable: true + type: string + securityContext: + nullable: true + properties: + fsGroup: + nullable: true + type: integer + fsGroupChangePolicy: + nullable: true + type: string + runAsGroup: + nullable: true + type: integer + runAsNonRoot: + nullable: true + type: boolean + runAsUser: + nullable: true + type: integer + seLinuxOptions: + nullable: true + properties: + level: + nullable: true + type: string + role: + nullable: true + type: string + type: + nullable: true + type: string + user: + nullable: true + type: string + type: object + seccompProfile: + nullable: true + properties: + localhostProfile: + nullable: true + type: string + type: + nullable: true + type: string + type: object + supplementalGroups: + items: + type: integer + nullable: true + type: array + sysctls: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + windowsOptions: + nullable: true + properties: + gmsaCredentialSpec: + nullable: true + type: string + gmsaCredentialSpecName: + nullable: true + type: string + hostProcess: + nullable: true + type: boolean + runAsUserName: + nullable: true + type: string + type: object + type: object + serviceAccount: + nullable: true + type: string + serviceAccountName: + nullable: true + type: string + setHostnameAsFQDN: + nullable: true + type: boolean + shareProcessNamespace: + nullable: true + type: boolean + subdomain: + nullable: true + type: string + terminationGracePeriodSeconds: + nullable: true + type: integer + tolerations: + items: + properties: + effect: + nullable: true + type: string + key: + nullable: true + type: string + operator: + nullable: true + type: string + tolerationSeconds: + nullable: true + type: integer + value: + nullable: true + type: string + type: object + nullable: true + type: array + topologySpreadConstraints: + items: + properties: + labelSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + matchLabelKeys: + items: + nullable: true + type: string + nullable: true + type: array + maxSkew: + type: integer + minDomains: + nullable: true + type: integer + nodeAffinityPolicy: + nullable: true + type: string + nodeTaintsPolicy: + nullable: true + type: string + topologyKey: + nullable: true + type: string + whenUnsatisfiable: + nullable: true + type: string + type: object + nullable: true + type: array + volumes: + items: + properties: + awsElasticBlockStore: + nullable: true + properties: + fsType: + nullable: true + type: string + partition: + type: integer + readOnly: + type: boolean + volumeID: + nullable: true + type: string + type: object + azureDisk: + nullable: true + properties: + cachingMode: + nullable: true + type: string + diskName: + nullable: true + type: string + diskURI: + nullable: true + type: string + fsType: + nullable: true + type: string + kind: + nullable: true + type: string + readOnly: + nullable: true + type: boolean + type: object + azureFile: + nullable: true + properties: + readOnly: + type: boolean + secretName: + nullable: true + type: string + shareName: + nullable: true + type: string + type: object + cephfs: + nullable: true + properties: + monitors: + items: + nullable: true + type: string + nullable: true + type: array + path: + nullable: true + type: string + readOnly: + type: boolean + secretFile: + nullable: true + type: string + secretRef: + nullable: true + properties: + name: + nullable: true + type: string + type: object + user: + nullable: true + type: string + type: object + cinder: + nullable: true + properties: + fsType: + nullable: true + type: string + readOnly: + type: boolean + secretRef: + nullable: true + properties: + name: + nullable: true + type: string + type: object + volumeID: + nullable: true + type: string + type: object + configMap: + nullable: true + properties: + defaultMode: + nullable: true + type: integer + items: + items: + properties: + key: + nullable: true + type: string + mode: + nullable: true + type: integer + path: + nullable: true + type: string + type: object + nullable: true + type: array + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + csi: + nullable: true + properties: + driver: + nullable: true + type: string + fsType: + nullable: true + type: string + nodePublishSecretRef: + nullable: true + properties: + name: + nullable: true + type: string + type: object + readOnly: + nullable: true + type: boolean + volumeAttributes: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + downwardAPI: + nullable: true + properties: + defaultMode: + nullable: true + type: integer + items: + items: + properties: + fieldRef: + nullable: true + properties: + apiVersion: + nullable: true + type: string + fieldPath: + nullable: true + type: string + type: object + mode: + nullable: true + type: integer + path: + nullable: true + type: string + resourceFieldRef: + nullable: true + properties: + containerName: + nullable: true + type: string + divisor: + nullable: true + type: string + resource: + nullable: true + type: string + type: object + type: object + nullable: true + type: array + type: object + emptyDir: + nullable: true + properties: + medium: + nullable: true + type: string + sizeLimit: + nullable: true + type: string + type: object + ephemeral: + nullable: true + properties: + volumeClaimTemplate: + nullable: true + properties: + metadata: + properties: + annotations: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + creationTimestamp: + nullable: true + type: string + deletionGracePeriodSeconds: + nullable: true + type: integer + deletionTimestamp: + nullable: true + type: string + finalizers: + items: + nullable: true + type: string + nullable: true + type: array + generateName: + nullable: true + type: string + generation: + type: integer + labels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + managedFields: + items: + properties: + apiVersion: + nullable: true + type: string + fieldsType: + nullable: true + type: string + fieldsV1: + nullable: true + type: object + manager: + nullable: true + type: string + operation: + nullable: true + type: string + subresource: + nullable: true + type: string + time: + nullable: true + type: string + type: object + nullable: true + type: array + name: + nullable: true + type: string + namespace: + nullable: true + type: string + ownerReferences: + items: + properties: + apiVersion: + nullable: true + type: string + blockOwnerDeletion: + nullable: true + type: boolean + controller: + nullable: true + type: boolean + kind: + nullable: true + type: string + name: + nullable: true + type: string + uid: + nullable: true + type: string + type: object + nullable: true + type: array + resourceVersion: + nullable: true + type: string + selfLink: + nullable: true + type: string + uid: + nullable: true + type: string + type: object + spec: + properties: + accessModes: + items: + nullable: true + type: string + nullable: true + type: array + dataSource: + nullable: true + properties: + apiGroup: + nullable: true + type: string + kind: + nullable: true + type: string + name: + nullable: true + type: string + type: object + dataSourceRef: + nullable: true + properties: + apiGroup: + nullable: true + type: string + kind: + nullable: true + type: string + name: + nullable: true + type: string + type: object + resources: + properties: + limits: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + requests: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + selector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + storageClassName: + nullable: true + type: string + volumeMode: + nullable: true + type: string + volumeName: + nullable: true + type: string + type: object + type: object + type: object + fc: + nullable: true + properties: + fsType: + nullable: true + type: string + lun: + nullable: true + type: integer + readOnly: + type: boolean + targetWWNs: + items: + nullable: true + type: string + nullable: true + type: array + wwids: + items: + nullable: true + type: string + nullable: true + type: array + type: object + flexVolume: + nullable: true + properties: + driver: + nullable: true + type: string + fsType: + nullable: true + type: string + options: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + readOnly: + type: boolean + secretRef: + nullable: true + properties: + name: + nullable: true + type: string + type: object + type: object + flocker: + nullable: true + properties: + datasetName: + nullable: true + type: string + datasetUUID: + nullable: true + type: string + type: object + gcePersistentDisk: + nullable: true + properties: + fsType: + nullable: true + type: string + partition: + type: integer + pdName: + nullable: true + type: string + readOnly: + type: boolean + type: object + gitRepo: + nullable: true + properties: + directory: + nullable: true + type: string + repository: + nullable: true + type: string + revision: + nullable: true + type: string + type: object + glusterfs: + nullable: true + properties: + endpoints: + nullable: true + type: string + path: + nullable: true + type: string + readOnly: + type: boolean + type: object + hostPath: + nullable: true + properties: + path: + nullable: true + type: string + type: + nullable: true + type: string + type: object + iscsi: + nullable: true + properties: + chapAuthDiscovery: + type: boolean + chapAuthSession: + type: boolean + fsType: + nullable: true + type: string + initiatorName: + nullable: true + type: string + iqn: + nullable: true + type: string + iscsiInterface: + nullable: true + type: string + lun: + type: integer + portals: + items: + nullable: true + type: string + nullable: true + type: array + readOnly: + type: boolean + secretRef: + nullable: true + properties: + name: + nullable: true + type: string + type: object + targetPortal: + nullable: true + type: string + type: object + name: + nullable: true + type: string + nfs: + nullable: true + properties: + path: + nullable: true + type: string + readOnly: + type: boolean + server: + nullable: true + type: string + type: object + persistentVolumeClaim: + nullable: true + properties: + claimName: + nullable: true + type: string + readOnly: + type: boolean + type: object + photonPersistentDisk: + nullable: true + properties: + fsType: + nullable: true + type: string + pdID: + nullable: true + type: string + type: object + portworxVolume: + nullable: true + properties: + fsType: + nullable: true + type: string + readOnly: + type: boolean + volumeID: + nullable: true + type: string + type: object + projected: + nullable: true + properties: + defaultMode: + nullable: true + type: integer + sources: + items: + properties: + configMap: + nullable: true + properties: + items: + items: + properties: + key: + nullable: true + type: string + mode: + nullable: true + type: integer + path: + nullable: true + type: string + type: object + nullable: true + type: array + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + downwardAPI: + nullable: true + properties: + items: + items: + properties: + fieldRef: + nullable: true + properties: + apiVersion: + nullable: true + type: string + fieldPath: + nullable: true + type: string + type: object + mode: + nullable: true + type: integer + path: + nullable: true + type: string + resourceFieldRef: + nullable: true + properties: + containerName: + nullable: true + type: string + divisor: + nullable: true + type: string + resource: + nullable: true + type: string + type: object + type: object + nullable: true + type: array + type: object + secret: + nullable: true + properties: + items: + items: + properties: + key: + nullable: true + type: string + mode: + nullable: true + type: integer + path: + nullable: true + type: string + type: object + nullable: true + type: array + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + serviceAccountToken: + nullable: true + properties: + audience: + nullable: true + type: string + expirationSeconds: + nullable: true + type: integer + path: + nullable: true + type: string + type: object + type: object + nullable: true + type: array + type: object + quobyte: + nullable: true + properties: + group: + nullable: true + type: string + readOnly: + type: boolean + registry: + nullable: true + type: string + tenant: + nullable: true + type: string + user: + nullable: true + type: string + volume: + nullable: true + type: string + type: object + rbd: + nullable: true + properties: + fsType: + nullable: true + type: string + image: + nullable: true + type: string + keyring: + nullable: true + type: string + monitors: + items: + nullable: true + type: string + nullable: true + type: array + pool: + nullable: true + type: string + readOnly: + type: boolean + secretRef: + nullable: true + properties: + name: + nullable: true + type: string + type: object + user: + nullable: true + type: string + type: object + scaleIO: + nullable: true + properties: + fsType: + nullable: true + type: string + gateway: + nullable: true + type: string + protectionDomain: + nullable: true + type: string + readOnly: + type: boolean + secretRef: + nullable: true + properties: + name: + nullable: true + type: string + type: object + sslEnabled: + type: boolean + storageMode: + nullable: true + type: string + storagePool: + nullable: true + type: string + system: + nullable: true + type: string + volumeName: + nullable: true + type: string + type: object + secret: + nullable: true + properties: + defaultMode: + nullable: true + type: integer + items: + items: + properties: + key: + nullable: true + type: string + mode: + nullable: true + type: integer + path: + nullable: true + type: string + type: object + nullable: true + type: array + optional: + nullable: true + type: boolean + secretName: + nullable: true + type: string + type: object + storageos: + nullable: true + properties: + fsType: + nullable: true + type: string + readOnly: + type: boolean + secretRef: + nullable: true + properties: + name: + nullable: true + type: string + type: object + volumeName: + nullable: true + type: string + volumeNamespace: + nullable: true + type: string + type: object + vsphereVolume: + nullable: true + properties: + fsType: + nullable: true + type: string + storagePolicyID: + nullable: true + type: string + storagePolicyName: + nullable: true + type: string + volumePath: + nullable: true + type: string + type: object + type: object + nullable: true + type: array + type: object + type: object + ttlSecondsAfterFinished: + nullable: true + type: integer + type: object + syncInterval: + type: integer + type: object + status: + properties: + commit: + nullable: true + type: string + conditions: + items: + properties: + lastTransitionTime: + nullable: true + type: string + lastUpdateTime: + nullable: true + type: string + message: + nullable: true + type: string + reason: + nullable: true + type: string + status: + nullable: true + type: string + type: + nullable: true + type: string + type: object + nullable: true + type: array + event: + nullable: true + type: string + hookId: + nullable: true + type: string + jobStatus: + nullable: true + type: string + lastExecutedCommit: + nullable: true + type: string + lastSyncedTime: + nullable: true + type: string + observedGeneration: + type: integer + secretToken: + nullable: true + type: string + updateGeneration: + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} +{{- else -}} +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: gitjobs.gitjob.cattle.io +spec: + additionalPrinterColumns: + - JSONPath: .spec.git.repo + name: REPO + type: string + - JSONPath: .spec.git.branch + name: BRANCH + type: string + - JSONPath: .status.commit + name: COMMIT + type: string + - JSONPath: .status.jobStatus + name: JOBSTATUS + type: string + - JSONPath: .metadata.creationTimestamp + name: Age + type: date + group: gitjob.cattle.io + names: + kind: GitJob + plural: gitjobs + singular: gitjob + preserveUnknownFields: false + scope: Namespaced + subresources: + status: {} + validation: + openAPIV3Schema: + properties: + spec: + properties: + forceUpdateGeneration: + type: integer + git: + properties: + branch: + nullable: true + type: string + caBundle: + nullable: true + type: string + clientSecretName: + nullable: true + type: string + insecureSkipTLSVerify: + type: boolean + onTag: + nullable: true + type: string + provider: + nullable: true + type: string + repo: + nullable: true + type: string + revision: + nullable: true + type: string + type: object + jobSpec: + properties: + activeDeadlineSeconds: + nullable: true + type: integer + backoffLimit: + nullable: true + type: integer + completionMode: + nullable: true + type: string + completions: + nullable: true + type: integer + manualSelector: + nullable: true + type: boolean + parallelism: + nullable: true + type: integer + podFailurePolicy: + nullable: true + properties: + rules: + items: + properties: + action: + nullable: true + type: string + onExitCodes: + nullable: true + properties: + containerName: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + type: integer + nullable: true + type: array + type: object + onPodConditions: + items: + properties: + status: + nullable: true + type: string + type: + nullable: true + type: string + type: object + nullable: true + type: array + type: object + nullable: true + type: array + type: object + selector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + suspend: + nullable: true + type: boolean + template: + properties: + metadata: + properties: + annotations: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + creationTimestamp: + nullable: true + type: string + deletionGracePeriodSeconds: + nullable: true + type: integer + deletionTimestamp: + nullable: true + type: string + finalizers: + items: + nullable: true + type: string + nullable: true + type: array + generateName: + nullable: true + type: string + generation: + type: integer + labels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + managedFields: + items: + properties: + apiVersion: + nullable: true + type: string + fieldsType: + nullable: true + type: string + fieldsV1: + nullable: true + type: object + manager: + nullable: true + type: string + operation: + nullable: true + type: string + subresource: + nullable: true + type: string + time: + nullable: true + type: string + type: object + nullable: true + type: array + name: + nullable: true + type: string + namespace: + nullable: true + type: string + ownerReferences: + items: + properties: + apiVersion: + nullable: true + type: string + blockOwnerDeletion: + nullable: true + type: boolean + controller: + nullable: true + type: boolean + kind: + nullable: true + type: string + name: + nullable: true + type: string + uid: + nullable: true + type: string + type: object + nullable: true + type: array + resourceVersion: + nullable: true + type: string + selfLink: + nullable: true + type: string + uid: + nullable: true + type: string + type: object + spec: + properties: + activeDeadlineSeconds: + nullable: true + type: integer + affinity: + nullable: true + properties: + nodeAffinity: + nullable: true + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + preference: + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchFields: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + type: object + weight: + type: integer + type: object + nullable: true + type: array + requiredDuringSchedulingIgnoredDuringExecution: + nullable: true + properties: + nodeSelectorTerms: + items: + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchFields: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + type: object + nullable: true + type: array + type: object + type: object + podAffinity: + nullable: true + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + namespaceSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + namespaces: + items: + nullable: true + type: string + nullable: true + type: array + topologyKey: + nullable: true + type: string + type: object + weight: + type: integer + type: object + nullable: true + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + namespaceSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + namespaces: + items: + nullable: true + type: string + nullable: true + type: array + topologyKey: + nullable: true + type: string + type: object + nullable: true + type: array + type: object + podAntiAffinity: + nullable: true + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + namespaceSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + namespaces: + items: + nullable: true + type: string + nullable: true + type: array + topologyKey: + nullable: true + type: string + type: object + weight: + type: integer + type: object + nullable: true + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + namespaceSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + namespaces: + items: + nullable: true + type: string + nullable: true + type: array + topologyKey: + nullable: true + type: string + type: object + nullable: true + type: array + type: object + type: object + automountServiceAccountToken: + nullable: true + type: boolean + containers: + items: + properties: + args: + items: + nullable: true + type: string + nullable: true + type: array + command: + items: + nullable: true + type: string + nullable: true + type: array + env: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + valueFrom: + nullable: true + properties: + configMapKeyRef: + nullable: true + properties: + key: + nullable: true + type: string + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + fieldRef: + nullable: true + properties: + apiVersion: + nullable: true + type: string + fieldPath: + nullable: true + type: string + type: object + resourceFieldRef: + nullable: true + properties: + containerName: + nullable: true + type: string + divisor: + nullable: true + type: string + resource: + nullable: true + type: string + type: object + secretKeyRef: + nullable: true + properties: + key: + nullable: true + type: string + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + type: object + type: object + nullable: true + type: array + envFrom: + items: + properties: + configMapRef: + nullable: true + properties: + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + prefix: + nullable: true + type: string + secretRef: + nullable: true + properties: + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + type: object + nullable: true + type: array + image: + nullable: true + type: string + imagePullPolicy: + nullable: true + type: string + lifecycle: + nullable: true + properties: + postStart: + nullable: true + properties: + exec: + nullable: true + properties: + command: + items: + nullable: true + type: string + nullable: true + type: array + type: object + httpGet: + nullable: true + properties: + host: + nullable: true + type: string + httpHeaders: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + path: + nullable: true + type: string + port: + nullable: true + type: string + scheme: + nullable: true + type: string + type: object + tcpSocket: + nullable: true + properties: + host: + nullable: true + type: string + port: + nullable: true + type: string + type: object + type: object + preStop: + nullable: true + properties: + exec: + nullable: true + properties: + command: + items: + nullable: true + type: string + nullable: true + type: array + type: object + httpGet: + nullable: true + properties: + host: + nullable: true + type: string + httpHeaders: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + path: + nullable: true + type: string + port: + nullable: true + type: string + scheme: + nullable: true + type: string + type: object + tcpSocket: + nullable: true + properties: + host: + nullable: true + type: string + port: + nullable: true + type: string + type: object + type: object + type: object + livenessProbe: + nullable: true + properties: + exec: + nullable: true + properties: + command: + items: + nullable: true + type: string + nullable: true + type: array + type: object + failureThreshold: + type: integer + grpc: + nullable: true + properties: + port: + type: integer + service: + nullable: true + type: string + type: object + httpGet: + nullable: true + properties: + host: + nullable: true + type: string + httpHeaders: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + path: + nullable: true + type: string + port: + nullable: true + type: string + scheme: + nullable: true + type: string + type: object + initialDelaySeconds: + type: integer + periodSeconds: + type: integer + successThreshold: + type: integer + tcpSocket: + nullable: true + properties: + host: + nullable: true + type: string + port: + nullable: true + type: string + type: object + terminationGracePeriodSeconds: + nullable: true + type: integer + timeoutSeconds: + type: integer + type: object + name: + nullable: true + type: string + ports: + items: + properties: + containerPort: + type: integer + hostIP: + nullable: true + type: string + hostPort: + type: integer + name: + nullable: true + type: string + protocol: + nullable: true + type: string + type: object + nullable: true + type: array + readinessProbe: + nullable: true + properties: + exec: + nullable: true + properties: + command: + items: + nullable: true + type: string + nullable: true + type: array + type: object + failureThreshold: + type: integer + grpc: + nullable: true + properties: + port: + type: integer + service: + nullable: true + type: string + type: object + httpGet: + nullable: true + properties: + host: + nullable: true + type: string + httpHeaders: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + path: + nullable: true + type: string + port: + nullable: true + type: string + scheme: + nullable: true + type: string + type: object + initialDelaySeconds: + type: integer + periodSeconds: + type: integer + successThreshold: + type: integer + tcpSocket: + nullable: true + properties: + host: + nullable: true + type: string + port: + nullable: true + type: string + type: object + terminationGracePeriodSeconds: + nullable: true + type: integer + timeoutSeconds: + type: integer + type: object + resources: + properties: + limits: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + requests: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + securityContext: + nullable: true + properties: + allowPrivilegeEscalation: + nullable: true + type: boolean + capabilities: + nullable: true + properties: + add: + items: + nullable: true + type: string + nullable: true + type: array + drop: + items: + nullable: true + type: string + nullable: true + type: array + type: object + privileged: + nullable: true + type: boolean + procMount: + nullable: true + type: string + readOnlyRootFilesystem: + nullable: true + type: boolean + runAsGroup: + nullable: true + type: integer + runAsNonRoot: + nullable: true + type: boolean + runAsUser: + nullable: true + type: integer + seLinuxOptions: + nullable: true + properties: + level: + nullable: true + type: string + role: + nullable: true + type: string + type: + nullable: true + type: string + user: + nullable: true + type: string + type: object + seccompProfile: + nullable: true + properties: + localhostProfile: + nullable: true + type: string + type: + nullable: true + type: string + type: object + windowsOptions: + nullable: true + properties: + gmsaCredentialSpec: + nullable: true + type: string + gmsaCredentialSpecName: + nullable: true + type: string + hostProcess: + nullable: true + type: boolean + runAsUserName: + nullable: true + type: string + type: object + type: object + startupProbe: + nullable: true + properties: + exec: + nullable: true + properties: + command: + items: + nullable: true + type: string + nullable: true + type: array + type: object + failureThreshold: + type: integer + grpc: + nullable: true + properties: + port: + type: integer + service: + nullable: true + type: string + type: object + httpGet: + nullable: true + properties: + host: + nullable: true + type: string + httpHeaders: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + path: + nullable: true + type: string + port: + nullable: true + type: string + scheme: + nullable: true + type: string + type: object + initialDelaySeconds: + type: integer + periodSeconds: + type: integer + successThreshold: + type: integer + tcpSocket: + nullable: true + properties: + host: + nullable: true + type: string + port: + nullable: true + type: string + type: object + terminationGracePeriodSeconds: + nullable: true + type: integer + timeoutSeconds: + type: integer + type: object + stdin: + type: boolean + stdinOnce: + type: boolean + terminationMessagePath: + nullable: true + type: string + terminationMessagePolicy: + nullable: true + type: string + tty: + type: boolean + volumeDevices: + items: + properties: + devicePath: + nullable: true + type: string + name: + nullable: true + type: string + type: object + nullable: true + type: array + volumeMounts: + items: + properties: + mountPath: + nullable: true + type: string + mountPropagation: + nullable: true + type: string + name: + nullable: true + type: string + readOnly: + type: boolean + subPath: + nullable: true + type: string + subPathExpr: + nullable: true + type: string + type: object + nullable: true + type: array + workingDir: + nullable: true + type: string + type: object + nullable: true + type: array + dnsConfig: + nullable: true + properties: + nameservers: + items: + nullable: true + type: string + nullable: true + type: array + options: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + searches: + items: + nullable: true + type: string + nullable: true + type: array + type: object + dnsPolicy: + nullable: true + type: string + enableServiceLinks: + nullable: true + type: boolean + ephemeralContainers: + items: + properties: + args: + items: + nullable: true + type: string + nullable: true + type: array + command: + items: + nullable: true + type: string + nullable: true + type: array + env: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + valueFrom: + nullable: true + properties: + configMapKeyRef: + nullable: true + properties: + key: + nullable: true + type: string + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + fieldRef: + nullable: true + properties: + apiVersion: + nullable: true + type: string + fieldPath: + nullable: true + type: string + type: object + resourceFieldRef: + nullable: true + properties: + containerName: + nullable: true + type: string + divisor: + nullable: true + type: string + resource: + nullable: true + type: string + type: object + secretKeyRef: + nullable: true + properties: + key: + nullable: true + type: string + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + type: object + type: object + nullable: true + type: array + envFrom: + items: + properties: + configMapRef: + nullable: true + properties: + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + prefix: + nullable: true + type: string + secretRef: + nullable: true + properties: + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + type: object + nullable: true + type: array + image: + nullable: true + type: string + imagePullPolicy: + nullable: true + type: string + lifecycle: + nullable: true + properties: + postStart: + nullable: true + properties: + exec: + nullable: true + properties: + command: + items: + nullable: true + type: string + nullable: true + type: array + type: object + httpGet: + nullable: true + properties: + host: + nullable: true + type: string + httpHeaders: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + path: + nullable: true + type: string + port: + nullable: true + type: string + scheme: + nullable: true + type: string + type: object + tcpSocket: + nullable: true + properties: + host: + nullable: true + type: string + port: + nullable: true + type: string + type: object + type: object + preStop: + nullable: true + properties: + exec: + nullable: true + properties: + command: + items: + nullable: true + type: string + nullable: true + type: array + type: object + httpGet: + nullable: true + properties: + host: + nullable: true + type: string + httpHeaders: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + path: + nullable: true + type: string + port: + nullable: true + type: string + scheme: + nullable: true + type: string + type: object + tcpSocket: + nullable: true + properties: + host: + nullable: true + type: string + port: + nullable: true + type: string + type: object + type: object + type: object + livenessProbe: + nullable: true + properties: + exec: + nullable: true + properties: + command: + items: + nullable: true + type: string + nullable: true + type: array + type: object + failureThreshold: + type: integer + grpc: + nullable: true + properties: + port: + type: integer + service: + nullable: true + type: string + type: object + httpGet: + nullable: true + properties: + host: + nullable: true + type: string + httpHeaders: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + path: + nullable: true + type: string + port: + nullable: true + type: string + scheme: + nullable: true + type: string + type: object + initialDelaySeconds: + type: integer + periodSeconds: + type: integer + successThreshold: + type: integer + tcpSocket: + nullable: true + properties: + host: + nullable: true + type: string + port: + nullable: true + type: string + type: object + terminationGracePeriodSeconds: + nullable: true + type: integer + timeoutSeconds: + type: integer + type: object + name: + nullable: true + type: string + ports: + items: + properties: + containerPort: + type: integer + hostIP: + nullable: true + type: string + hostPort: + type: integer + name: + nullable: true + type: string + protocol: + nullable: true + type: string + type: object + nullable: true + type: array + readinessProbe: + nullable: true + properties: + exec: + nullable: true + properties: + command: + items: + nullable: true + type: string + nullable: true + type: array + type: object + failureThreshold: + type: integer + grpc: + nullable: true + properties: + port: + type: integer + service: + nullable: true + type: string + type: object + httpGet: + nullable: true + properties: + host: + nullable: true + type: string + httpHeaders: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + path: + nullable: true + type: string + port: + nullable: true + type: string + scheme: + nullable: true + type: string + type: object + initialDelaySeconds: + type: integer + periodSeconds: + type: integer + successThreshold: + type: integer + tcpSocket: + nullable: true + properties: + host: + nullable: true + type: string + port: + nullable: true + type: string + type: object + terminationGracePeriodSeconds: + nullable: true + type: integer + timeoutSeconds: + type: integer + type: object + resources: + properties: + limits: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + requests: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + securityContext: + nullable: true + properties: + allowPrivilegeEscalation: + nullable: true + type: boolean + capabilities: + nullable: true + properties: + add: + items: + nullable: true + type: string + nullable: true + type: array + drop: + items: + nullable: true + type: string + nullable: true + type: array + type: object + privileged: + nullable: true + type: boolean + procMount: + nullable: true + type: string + readOnlyRootFilesystem: + nullable: true + type: boolean + runAsGroup: + nullable: true + type: integer + runAsNonRoot: + nullable: true + type: boolean + runAsUser: + nullable: true + type: integer + seLinuxOptions: + nullable: true + properties: + level: + nullable: true + type: string + role: + nullable: true + type: string + type: + nullable: true + type: string + user: + nullable: true + type: string + type: object + seccompProfile: + nullable: true + properties: + localhostProfile: + nullable: true + type: string + type: + nullable: true + type: string + type: object + windowsOptions: + nullable: true + properties: + gmsaCredentialSpec: + nullable: true + type: string + gmsaCredentialSpecName: + nullable: true + type: string + hostProcess: + nullable: true + type: boolean + runAsUserName: + nullable: true + type: string + type: object + type: object + startupProbe: + nullable: true + properties: + exec: + nullable: true + properties: + command: + items: + nullable: true + type: string + nullable: true + type: array + type: object + failureThreshold: + type: integer + grpc: + nullable: true + properties: + port: + type: integer + service: + nullable: true + type: string + type: object + httpGet: + nullable: true + properties: + host: + nullable: true + type: string + httpHeaders: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + path: + nullable: true + type: string + port: + nullable: true + type: string + scheme: + nullable: true + type: string + type: object + initialDelaySeconds: + type: integer + periodSeconds: + type: integer + successThreshold: + type: integer + tcpSocket: + nullable: true + properties: + host: + nullable: true + type: string + port: + nullable: true + type: string + type: object + terminationGracePeriodSeconds: + nullable: true + type: integer + timeoutSeconds: + type: integer + type: object + stdin: + type: boolean + stdinOnce: + type: boolean + targetContainerName: + nullable: true + type: string + terminationMessagePath: + nullable: true + type: string + terminationMessagePolicy: + nullable: true + type: string + tty: + type: boolean + volumeDevices: + items: + properties: + devicePath: + nullable: true + type: string + name: + nullable: true + type: string + type: object + nullable: true + type: array + volumeMounts: + items: + properties: + mountPath: + nullable: true + type: string + mountPropagation: + nullable: true + type: string + name: + nullable: true + type: string + readOnly: + type: boolean + subPath: + nullable: true + type: string + subPathExpr: + nullable: true + type: string + type: object + nullable: true + type: array + workingDir: + nullable: true + type: string + type: object + nullable: true + type: array + hostAliases: + items: + properties: + hostnames: + items: + nullable: true + type: string + nullable: true + type: array + ip: + nullable: true + type: string + type: object + nullable: true + type: array + hostIPC: + type: boolean + hostNetwork: + type: boolean + hostPID: + type: boolean + hostUsers: + nullable: true + type: boolean + hostname: + nullable: true + type: string + imagePullSecrets: + items: + properties: + name: + nullable: true + type: string + type: object + nullable: true + type: array + initContainers: + items: + properties: + args: + items: + nullable: true + type: string + nullable: true + type: array + command: + items: + nullable: true + type: string + nullable: true + type: array + env: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + valueFrom: + nullable: true + properties: + configMapKeyRef: + nullable: true + properties: + key: + nullable: true + type: string + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + fieldRef: + nullable: true + properties: + apiVersion: + nullable: true + type: string + fieldPath: + nullable: true + type: string + type: object + resourceFieldRef: + nullable: true + properties: + containerName: + nullable: true + type: string + divisor: + nullable: true + type: string + resource: + nullable: true + type: string + type: object + secretKeyRef: + nullable: true + properties: + key: + nullable: true + type: string + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + type: object + type: object + nullable: true + type: array + envFrom: + items: + properties: + configMapRef: + nullable: true + properties: + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + prefix: + nullable: true + type: string + secretRef: + nullable: true + properties: + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + type: object + nullable: true + type: array + image: + nullable: true + type: string + imagePullPolicy: + nullable: true + type: string + lifecycle: + nullable: true + properties: + postStart: + nullable: true + properties: + exec: + nullable: true + properties: + command: + items: + nullable: true + type: string + nullable: true + type: array + type: object + httpGet: + nullable: true + properties: + host: + nullable: true + type: string + httpHeaders: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + path: + nullable: true + type: string + port: + nullable: true + type: string + scheme: + nullable: true + type: string + type: object + tcpSocket: + nullable: true + properties: + host: + nullable: true + type: string + port: + nullable: true + type: string + type: object + type: object + preStop: + nullable: true + properties: + exec: + nullable: true + properties: + command: + items: + nullable: true + type: string + nullable: true + type: array + type: object + httpGet: + nullable: true + properties: + host: + nullable: true + type: string + httpHeaders: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + path: + nullable: true + type: string + port: + nullable: true + type: string + scheme: + nullable: true + type: string + type: object + tcpSocket: + nullable: true + properties: + host: + nullable: true + type: string + port: + nullable: true + type: string + type: object + type: object + type: object + livenessProbe: + nullable: true + properties: + exec: + nullable: true + properties: + command: + items: + nullable: true + type: string + nullable: true + type: array + type: object + failureThreshold: + type: integer + grpc: + nullable: true + properties: + port: + type: integer + service: + nullable: true + type: string + type: object + httpGet: + nullable: true + properties: + host: + nullable: true + type: string + httpHeaders: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + path: + nullable: true + type: string + port: + nullable: true + type: string + scheme: + nullable: true + type: string + type: object + initialDelaySeconds: + type: integer + periodSeconds: + type: integer + successThreshold: + type: integer + tcpSocket: + nullable: true + properties: + host: + nullable: true + type: string + port: + nullable: true + type: string + type: object + terminationGracePeriodSeconds: + nullable: true + type: integer + timeoutSeconds: + type: integer + type: object + name: + nullable: true + type: string + ports: + items: + properties: + containerPort: + type: integer + hostIP: + nullable: true + type: string + hostPort: + type: integer + name: + nullable: true + type: string + protocol: + nullable: true + type: string + type: object + nullable: true + type: array + readinessProbe: + nullable: true + properties: + exec: + nullable: true + properties: + command: + items: + nullable: true + type: string + nullable: true + type: array + type: object + failureThreshold: + type: integer + grpc: + nullable: true + properties: + port: + type: integer + service: + nullable: true + type: string + type: object + httpGet: + nullable: true + properties: + host: + nullable: true + type: string + httpHeaders: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + path: + nullable: true + type: string + port: + nullable: true + type: string + scheme: + nullable: true + type: string + type: object + initialDelaySeconds: + type: integer + periodSeconds: + type: integer + successThreshold: + type: integer + tcpSocket: + nullable: true + properties: + host: + nullable: true + type: string + port: + nullable: true + type: string + type: object + terminationGracePeriodSeconds: + nullable: true + type: integer + timeoutSeconds: + type: integer + type: object + resources: + properties: + limits: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + requests: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + securityContext: + nullable: true + properties: + allowPrivilegeEscalation: + nullable: true + type: boolean + capabilities: + nullable: true + properties: + add: + items: + nullable: true + type: string + nullable: true + type: array + drop: + items: + nullable: true + type: string + nullable: true + type: array + type: object + privileged: + nullable: true + type: boolean + procMount: + nullable: true + type: string + readOnlyRootFilesystem: + nullable: true + type: boolean + runAsGroup: + nullable: true + type: integer + runAsNonRoot: + nullable: true + type: boolean + runAsUser: + nullable: true + type: integer + seLinuxOptions: + nullable: true + properties: + level: + nullable: true + type: string + role: + nullable: true + type: string + type: + nullable: true + type: string + user: + nullable: true + type: string + type: object + seccompProfile: + nullable: true + properties: + localhostProfile: + nullable: true + type: string + type: + nullable: true + type: string + type: object + windowsOptions: + nullable: true + properties: + gmsaCredentialSpec: + nullable: true + type: string + gmsaCredentialSpecName: + nullable: true + type: string + hostProcess: + nullable: true + type: boolean + runAsUserName: + nullable: true + type: string + type: object + type: object + startupProbe: + nullable: true + properties: + exec: + nullable: true + properties: + command: + items: + nullable: true + type: string + nullable: true + type: array + type: object + failureThreshold: + type: integer + grpc: + nullable: true + properties: + port: + type: integer + service: + nullable: true + type: string + type: object + httpGet: + nullable: true + properties: + host: + nullable: true + type: string + httpHeaders: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + path: + nullable: true + type: string + port: + nullable: true + type: string + scheme: + nullable: true + type: string + type: object + initialDelaySeconds: + type: integer + periodSeconds: + type: integer + successThreshold: + type: integer + tcpSocket: + nullable: true + properties: + host: + nullable: true + type: string + port: + nullable: true + type: string + type: object + terminationGracePeriodSeconds: + nullable: true + type: integer + timeoutSeconds: + type: integer + type: object + stdin: + type: boolean + stdinOnce: + type: boolean + terminationMessagePath: + nullable: true + type: string + terminationMessagePolicy: + nullable: true + type: string + tty: + type: boolean + volumeDevices: + items: + properties: + devicePath: + nullable: true + type: string + name: + nullable: true + type: string + type: object + nullable: true + type: array + volumeMounts: + items: + properties: + mountPath: + nullable: true + type: string + mountPropagation: + nullable: true + type: string + name: + nullable: true + type: string + readOnly: + type: boolean + subPath: + nullable: true + type: string + subPathExpr: + nullable: true + type: string + type: object + nullable: true + type: array + workingDir: + nullable: true + type: string + type: object + nullable: true + type: array + nodeName: + nullable: true + type: string + nodeSelector: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + os: + nullable: true + properties: + name: + nullable: true + type: string + type: object + overhead: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + preemptionPolicy: + nullable: true + type: string + priority: + nullable: true + type: integer + priorityClassName: + nullable: true + type: string + readinessGates: + items: + properties: + conditionType: + nullable: true + type: string + type: object + nullable: true + type: array + restartPolicy: + nullable: true + type: string + runtimeClassName: + nullable: true + type: string + schedulerName: + nullable: true + type: string + securityContext: + nullable: true + properties: + fsGroup: + nullable: true + type: integer + fsGroupChangePolicy: + nullable: true + type: string + runAsGroup: + nullable: true + type: integer + runAsNonRoot: + nullable: true + type: boolean + runAsUser: + nullable: true + type: integer + seLinuxOptions: + nullable: true + properties: + level: + nullable: true + type: string + role: + nullable: true + type: string + type: + nullable: true + type: string + user: + nullable: true + type: string + type: object + seccompProfile: + nullable: true + properties: + localhostProfile: + nullable: true + type: string + type: + nullable: true + type: string + type: object + supplementalGroups: + items: + type: integer + nullable: true + type: array + sysctls: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + type: object + nullable: true + type: array + windowsOptions: + nullable: true + properties: + gmsaCredentialSpec: + nullable: true + type: string + gmsaCredentialSpecName: + nullable: true + type: string + hostProcess: + nullable: true + type: boolean + runAsUserName: + nullable: true + type: string + type: object + type: object + serviceAccount: + nullable: true + type: string + serviceAccountName: + nullable: true + type: string + setHostnameAsFQDN: + nullable: true + type: boolean + shareProcessNamespace: + nullable: true + type: boolean + subdomain: + nullable: true + type: string + terminationGracePeriodSeconds: + nullable: true + type: integer + tolerations: + items: + properties: + effect: + nullable: true + type: string + key: + nullable: true + type: string + operator: + nullable: true + type: string + tolerationSeconds: + nullable: true + type: integer + value: + nullable: true + type: string + type: object + nullable: true + type: array + topologySpreadConstraints: + items: + properties: + labelSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + matchLabelKeys: + items: + nullable: true + type: string + nullable: true + type: array + maxSkew: + type: integer + minDomains: + nullable: true + type: integer + nodeAffinityPolicy: + nullable: true + type: string + nodeTaintsPolicy: + nullable: true + type: string + topologyKey: + nullable: true + type: string + whenUnsatisfiable: + nullable: true + type: string + type: object + nullable: true + type: array + volumes: + items: + properties: + awsElasticBlockStore: + nullable: true + properties: + fsType: + nullable: true + type: string + partition: + type: integer + readOnly: + type: boolean + volumeID: + nullable: true + type: string + type: object + azureDisk: + nullable: true + properties: + cachingMode: + nullable: true + type: string + diskName: + nullable: true + type: string + diskURI: + nullable: true + type: string + fsType: + nullable: true + type: string + kind: + nullable: true + type: string + readOnly: + nullable: true + type: boolean + type: object + azureFile: + nullable: true + properties: + readOnly: + type: boolean + secretName: + nullable: true + type: string + shareName: + nullable: true + type: string + type: object + cephfs: + nullable: true + properties: + monitors: + items: + nullable: true + type: string + nullable: true + type: array + path: + nullable: true + type: string + readOnly: + type: boolean + secretFile: + nullable: true + type: string + secretRef: + nullable: true + properties: + name: + nullable: true + type: string + type: object + user: + nullable: true + type: string + type: object + cinder: + nullable: true + properties: + fsType: + nullable: true + type: string + readOnly: + type: boolean + secretRef: + nullable: true + properties: + name: + nullable: true + type: string + type: object + volumeID: + nullable: true + type: string + type: object + configMap: + nullable: true + properties: + defaultMode: + nullable: true + type: integer + items: + items: + properties: + key: + nullable: true + type: string + mode: + nullable: true + type: integer + path: + nullable: true + type: string + type: object + nullable: true + type: array + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + csi: + nullable: true + properties: + driver: + nullable: true + type: string + fsType: + nullable: true + type: string + nodePublishSecretRef: + nullable: true + properties: + name: + nullable: true + type: string + type: object + readOnly: + nullable: true + type: boolean + volumeAttributes: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + downwardAPI: + nullable: true + properties: + defaultMode: + nullable: true + type: integer + items: + items: + properties: + fieldRef: + nullable: true + properties: + apiVersion: + nullable: true + type: string + fieldPath: + nullable: true + type: string + type: object + mode: + nullable: true + type: integer + path: + nullable: true + type: string + resourceFieldRef: + nullable: true + properties: + containerName: + nullable: true + type: string + divisor: + nullable: true + type: string + resource: + nullable: true + type: string + type: object + type: object + nullable: true + type: array + type: object + emptyDir: + nullable: true + properties: + medium: + nullable: true + type: string + sizeLimit: + nullable: true + type: string + type: object + ephemeral: + nullable: true + properties: + volumeClaimTemplate: + nullable: true + properties: + metadata: + properties: + annotations: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + creationTimestamp: + nullable: true + type: string + deletionGracePeriodSeconds: + nullable: true + type: integer + deletionTimestamp: + nullable: true + type: string + finalizers: + items: + nullable: true + type: string + nullable: true + type: array + generateName: + nullable: true + type: string + generation: + type: integer + labels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + managedFields: + items: + properties: + apiVersion: + nullable: true + type: string + fieldsType: + nullable: true + type: string + fieldsV1: + nullable: true + type: object + manager: + nullable: true + type: string + operation: + nullable: true + type: string + subresource: + nullable: true + type: string + time: + nullable: true + type: string + type: object + nullable: true + type: array + name: + nullable: true + type: string + namespace: + nullable: true + type: string + ownerReferences: + items: + properties: + apiVersion: + nullable: true + type: string + blockOwnerDeletion: + nullable: true + type: boolean + controller: + nullable: true + type: boolean + kind: + nullable: true + type: string + name: + nullable: true + type: string + uid: + nullable: true + type: string + type: object + nullable: true + type: array + resourceVersion: + nullable: true + type: string + selfLink: + nullable: true + type: string + uid: + nullable: true + type: string + type: object + spec: + properties: + accessModes: + items: + nullable: true + type: string + nullable: true + type: array + dataSource: + nullable: true + properties: + apiGroup: + nullable: true + type: string + kind: + nullable: true + type: string + name: + nullable: true + type: string + type: object + dataSourceRef: + nullable: true + properties: + apiGroup: + nullable: true + type: string + kind: + nullable: true + type: string + name: + nullable: true + type: string + type: object + resources: + properties: + limits: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + requests: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + selector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + storageClassName: + nullable: true + type: string + volumeMode: + nullable: true + type: string + volumeName: + nullable: true + type: string + type: object + type: object + type: object + fc: + nullable: true + properties: + fsType: + nullable: true + type: string + lun: + nullable: true + type: integer + readOnly: + type: boolean + targetWWNs: + items: + nullable: true + type: string + nullable: true + type: array + wwids: + items: + nullable: true + type: string + nullable: true + type: array + type: object + flexVolume: + nullable: true + properties: + driver: + nullable: true + type: string + fsType: + nullable: true + type: string + options: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + readOnly: + type: boolean + secretRef: + nullable: true + properties: + name: + nullable: true + type: string + type: object + type: object + flocker: + nullable: true + properties: + datasetName: + nullable: true + type: string + datasetUUID: + nullable: true + type: string + type: object + gcePersistentDisk: + nullable: true + properties: + fsType: + nullable: true + type: string + partition: + type: integer + pdName: + nullable: true + type: string + readOnly: + type: boolean + type: object + gitRepo: + nullable: true + properties: + directory: + nullable: true + type: string + repository: + nullable: true + type: string + revision: + nullable: true + type: string + type: object + glusterfs: + nullable: true + properties: + endpoints: + nullable: true + type: string + path: + nullable: true + type: string + readOnly: + type: boolean + type: object + hostPath: + nullable: true + properties: + path: + nullable: true + type: string + type: + nullable: true + type: string + type: object + iscsi: + nullable: true + properties: + chapAuthDiscovery: + type: boolean + chapAuthSession: + type: boolean + fsType: + nullable: true + type: string + initiatorName: + nullable: true + type: string + iqn: + nullable: true + type: string + iscsiInterface: + nullable: true + type: string + lun: + type: integer + portals: + items: + nullable: true + type: string + nullable: true + type: array + readOnly: + type: boolean + secretRef: + nullable: true + properties: + name: + nullable: true + type: string + type: object + targetPortal: + nullable: true + type: string + type: object + name: + nullable: true + type: string + nfs: + nullable: true + properties: + path: + nullable: true + type: string + readOnly: + type: boolean + server: + nullable: true + type: string + type: object + persistentVolumeClaim: + nullable: true + properties: + claimName: + nullable: true + type: string + readOnly: + type: boolean + type: object + photonPersistentDisk: + nullable: true + properties: + fsType: + nullable: true + type: string + pdID: + nullable: true + type: string + type: object + portworxVolume: + nullable: true + properties: + fsType: + nullable: true + type: string + readOnly: + type: boolean + volumeID: + nullable: true + type: string + type: object + projected: + nullable: true + properties: + defaultMode: + nullable: true + type: integer + sources: + items: + properties: + configMap: + nullable: true + properties: + items: + items: + properties: + key: + nullable: true + type: string + mode: + nullable: true + type: integer + path: + nullable: true + type: string + type: object + nullable: true + type: array + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + downwardAPI: + nullable: true + properties: + items: + items: + properties: + fieldRef: + nullable: true + properties: + apiVersion: + nullable: true + type: string + fieldPath: + nullable: true + type: string + type: object + mode: + nullable: true + type: integer + path: + nullable: true + type: string + resourceFieldRef: + nullable: true + properties: + containerName: + nullable: true + type: string + divisor: + nullable: true + type: string + resource: + nullable: true + type: string + type: object + type: object + nullable: true + type: array + type: object + secret: + nullable: true + properties: + items: + items: + properties: + key: + nullable: true + type: string + mode: + nullable: true + type: integer + path: + nullable: true + type: string + type: object + nullable: true + type: array + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + serviceAccountToken: + nullable: true + properties: + audience: + nullable: true + type: string + expirationSeconds: + nullable: true + type: integer + path: + nullable: true + type: string + type: object + type: object + nullable: true + type: array + type: object + quobyte: + nullable: true + properties: + group: + nullable: true + type: string + readOnly: + type: boolean + registry: + nullable: true + type: string + tenant: + nullable: true + type: string + user: + nullable: true + type: string + volume: + nullable: true + type: string + type: object + rbd: + nullable: true + properties: + fsType: + nullable: true + type: string + image: + nullable: true + type: string + keyring: + nullable: true + type: string + monitors: + items: + nullable: true + type: string + nullable: true + type: array + pool: + nullable: true + type: string + readOnly: + type: boolean + secretRef: + nullable: true + properties: + name: + nullable: true + type: string + type: object + user: + nullable: true + type: string + type: object + scaleIO: + nullable: true + properties: + fsType: + nullable: true + type: string + gateway: + nullable: true + type: string + protectionDomain: + nullable: true + type: string + readOnly: + type: boolean + secretRef: + nullable: true + properties: + name: + nullable: true + type: string + type: object + sslEnabled: + type: boolean + storageMode: + nullable: true + type: string + storagePool: + nullable: true + type: string + system: + nullable: true + type: string + volumeName: + nullable: true + type: string + type: object + secret: + nullable: true + properties: + defaultMode: + nullable: true + type: integer + items: + items: + properties: + key: + nullable: true + type: string + mode: + nullable: true + type: integer + path: + nullable: true + type: string + type: object + nullable: true + type: array + optional: + nullable: true + type: boolean + secretName: + nullable: true + type: string + type: object + storageos: + nullable: true + properties: + fsType: + nullable: true + type: string + readOnly: + type: boolean + secretRef: + nullable: true + properties: + name: + nullable: true + type: string + type: object + volumeName: + nullable: true + type: string + volumeNamespace: + nullable: true + type: string + type: object + vsphereVolume: + nullable: true + properties: + fsType: + nullable: true + type: string + storagePolicyID: + nullable: true + type: string + storagePolicyName: + nullable: true + type: string + volumePath: + nullable: true + type: string + type: object + type: object + nullable: true + type: array + type: object + type: object + ttlSecondsAfterFinished: + nullable: true + type: integer + type: object + syncInterval: + type: integer + type: object + status: + properties: + commit: + nullable: true + type: string + conditions: + items: + properties: + lastTransitionTime: + nullable: true + type: string + lastUpdateTime: + nullable: true + type: string + message: + nullable: true + type: string + reason: + nullable: true + type: string + status: + nullable: true + type: string + type: + nullable: true + type: string + type: object + nullable: true + type: array + event: + nullable: true + type: string + hookId: + nullable: true + type: string + jobStatus: + nullable: true + type: string + lastExecutedCommit: + nullable: true + type: string + lastSyncedTime: + nullable: true + type: string + observedGeneration: + type: integer + secretToken: + nullable: true + type: string + updateGeneration: + type: integer + type: object + type: object + version: v1 + versions: + - name: v1 + served: true + storage: true +{{- end -}} diff --git a/charts/fleet-crd/102.2.0+up0.8.0/values.yaml b/charts/fleet-crd/102.2.0+up0.8.0/values.yaml new file mode 100644 index 000000000..d41d3a244 --- /dev/null +++ b/charts/fleet-crd/102.2.0+up0.8.0/values.yaml @@ -0,0 +1 @@ +# This file is intentionally empty diff --git a/charts/fleet/102.2.0+up0.8.0/Chart.yaml b/charts/fleet/102.2.0+up0.8.0/Chart.yaml new file mode 100644 index 000000000..7ccd3f423 --- /dev/null +++ b/charts/fleet/102.2.0+up0.8.0/Chart.yaml @@ -0,0 +1,22 @@ +annotations: + catalog.cattle.io/auto-install: fleet-crd=match + catalog.cattle.io/certified: rancher + catalog.cattle.io/experimental: "true" + catalog.cattle.io/hidden: "true" + catalog.cattle.io/kube-version: '>= 1.16.0-0 < 1.27.0-0' + catalog.cattle.io/namespace: cattle-fleet-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/provides-gvr: clusters.fleet.cattle.io/v1alpha1 + catalog.cattle.io/rancher-version: '>= 2.7.0-0 < 2.8.0-0' + catalog.cattle.io/release-name: fleet +apiVersion: v2 +appVersion: 0.8.0 +dependencies: +- condition: gitops.enabled + name: gitjob + repository: file://./charts/gitjob +description: Fleet Manager - GitOps at Scale +icon: https://charts.rancher.io/assets/logos/fleet.svg +name: fleet +version: 102.2.0+up0.8.0 diff --git a/charts/fleet/102.2.0+up0.8.0/README.md b/charts/fleet/102.2.0+up0.8.0/README.md new file mode 100644 index 000000000..2f2a4c302 --- /dev/null +++ b/charts/fleet/102.2.0+up0.8.0/README.md @@ -0,0 +1,30 @@ +# Fleet Helm Chart + +Fleet is GitOps at scale. Fleet is designed to manage multiple clusters. + +## What is Fleet? + +* Cluster engine: Fleet is a container management and deployment engine designed to offer users more control on the local cluster and constant monitoring through GitOps. Fleet focuses not only on the ability to scale, but it also gives users a high degree of control and visibility to monitor exactly what is installed on the cluster. + +* Deployment management: Fleet can manage deployments from git of raw Kubernetes YAML, Helm charts, Kustomize, or any combination of the three. Regardless of the source, all resources are dynamically turned into Helm charts, and Helm is used as the engine to deploy all resources in the cluster. As a result, users can enjoy a high degree of control, consistency, and auditability of their clusters. + +## Introduction + +This chart deploys Fleet on a Kubernetes cluster. It also deploys some of its dependencies as subcharts. + +The documentation is centralized in the [doc website](https://fleet.rancher.io/). + +## Prerequisites + +Get helm if you don't have it. Helm 3 is just a CLI. + + +## Install Fleet + +Install the Fleet Helm charts (there are two because we separate out CRDs for ultimate flexibility.): + +``` +$ helm repo add fleet https://rancher.github.io/fleet-helm-charts/ +$ helm -n cattle-fleet-system install --create-namespace --wait fleet-crd fleet/fleet-crd +$ helm -n cattle-fleet-system install --create-namespace --wait fleet fleet/fleet +``` \ No newline at end of file diff --git a/charts/fleet/102.2.0+up0.8.0/charts/gitjob/.helmignore b/charts/fleet/102.2.0+up0.8.0/charts/gitjob/.helmignore new file mode 100644 index 000000000..691fa13d6 --- /dev/null +++ b/charts/fleet/102.2.0+up0.8.0/charts/gitjob/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ \ No newline at end of file diff --git a/charts/fleet/102.2.0+up0.8.0/charts/gitjob/Chart.yaml b/charts/fleet/102.2.0+up0.8.0/charts/gitjob/Chart.yaml new file mode 100644 index 000000000..1da11d901 --- /dev/null +++ b/charts/fleet/102.2.0+up0.8.0/charts/gitjob/Chart.yaml @@ -0,0 +1,5 @@ +apiVersion: v2 +appVersion: 0.1.76 +description: Controller that run jobs based on git events +name: gitjob +version: 0.1.76 diff --git a/charts/fleet/102.2.0+up0.8.0/charts/gitjob/templates/_helpers.tpl b/charts/fleet/102.2.0+up0.8.0/charts/gitjob/templates/_helpers.tpl new file mode 100644 index 000000000..f652b5643 --- /dev/null +++ b/charts/fleet/102.2.0+up0.8.0/charts/gitjob/templates/_helpers.tpl @@ -0,0 +1,7 @@ +{{- define "system_default_registry" -}} +{{- if .Values.global.cattle.systemDefaultRegistry -}} +{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}} +{{- else -}} +{{- "" -}} +{{- end -}} +{{- end -}} \ No newline at end of file diff --git a/charts/fleet/102.2.0+up0.8.0/charts/gitjob/templates/clusterrole.yaml b/charts/fleet/102.2.0+up0.8.0/charts/gitjob/templates/clusterrole.yaml new file mode 100644 index 000000000..bcad90164 --- /dev/null +++ b/charts/fleet/102.2.0+up0.8.0/charts/gitjob/templates/clusterrole.yaml @@ -0,0 +1,38 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: gitjob +rules: + - apiGroups: + - "batch" + resources: + - 'jobs' + verbs: + - '*' + - apiGroups: + - "" + resources: + - 'pods' + verbs: + - 'list' + - 'get' + - 'watch' + - apiGroups: + - "" + resources: + - 'secrets' + verbs: + - '*' + - apiGroups: + - "" + resources: + - 'configmaps' + verbs: + - '*' + - apiGroups: + - "gitjob.cattle.io" + resources: + - "gitjobs" + - "gitjobs/status" + verbs: + - "*" \ No newline at end of file diff --git a/charts/fleet/102.2.0+up0.8.0/charts/gitjob/templates/clusterrolebinding.yaml b/charts/fleet/102.2.0+up0.8.0/charts/gitjob/templates/clusterrolebinding.yaml new file mode 100644 index 000000000..0bf07c4ef --- /dev/null +++ b/charts/fleet/102.2.0+up0.8.0/charts/gitjob/templates/clusterrolebinding.yaml @@ -0,0 +1,12 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: gitjob-binding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: gitjob +subjects: + - kind: ServiceAccount + name: gitjob + namespace: {{ .Release.Namespace }} \ No newline at end of file diff --git a/charts/fleet/102.2.0+up0.8.0/charts/gitjob/templates/deployment.yaml b/charts/fleet/102.2.0+up0.8.0/charts/gitjob/templates/deployment.yaml new file mode 100644 index 000000000..e7bbe5f20 --- /dev/null +++ b/charts/fleet/102.2.0+up0.8.0/charts/gitjob/templates/deployment.yaml @@ -0,0 +1,51 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: gitjob +spec: + selector: + matchLabels: + app: "gitjob" + template: + metadata: + labels: + app: "gitjob" + spec: + serviceAccountName: gitjob + containers: + - image: "{{ template "system_default_registry" . }}{{ .Values.gitjob.repository }}:{{ .Values.gitjob.tag }}" + name: gitjob + args: + {{- if .Values.debug }} + - --debug + {{- end }} + - --tekton-image + - "{{ template "system_default_registry" . }}{{ .Values.tekton.repository }}:{{ .Values.tekton.tag }}" + env: + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + {{- if .Values.proxy }} + - name: HTTP_PROXY + value: {{ .Values.proxy }} + - name: HTTPS_PROXY + value: {{ .Values.proxy }} + - name: NO_PROXY + value: {{ .Values.noProxy }} + {{- end }} + {{- if .Values.debug }} + - name: CATTLE_DEV_MODE + value: "true" + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if .Values.priorityClassName }} + priorityClassName: "{{.Values.priorityClassName}}" + {{- end }} diff --git a/charts/fleet/102.2.0+up0.8.0/charts/gitjob/templates/leases.yaml b/charts/fleet/102.2.0+up0.8.0/charts/gitjob/templates/leases.yaml new file mode 100644 index 000000000..51f933950 --- /dev/null +++ b/charts/fleet/102.2.0+up0.8.0/charts/gitjob/templates/leases.yaml @@ -0,0 +1,23 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: gitjob +rules: + - apiGroups: + - "coordination.k8s.io" + resources: + - "leases" + verbs: + - "*" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: gitjob +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: gitjob +subjects: + - kind: ServiceAccount + name: gitjob diff --git a/charts/fleet/102.2.0+up0.8.0/charts/gitjob/templates/service.yaml b/charts/fleet/102.2.0+up0.8.0/charts/gitjob/templates/service.yaml new file mode 100644 index 000000000..bf57c1b55 --- /dev/null +++ b/charts/fleet/102.2.0+up0.8.0/charts/gitjob/templates/service.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Service +metadata: + name: gitjob +spec: + ports: + - name: http-80 + port: 80 + protocol: TCP + targetPort: 8080 + selector: + app: "gitjob" \ No newline at end of file diff --git a/charts/fleet/102.2.0+up0.8.0/charts/gitjob/templates/serviceaccount.yaml b/charts/fleet/102.2.0+up0.8.0/charts/gitjob/templates/serviceaccount.yaml new file mode 100644 index 000000000..5f8aecb04 --- /dev/null +++ b/charts/fleet/102.2.0+up0.8.0/charts/gitjob/templates/serviceaccount.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: gitjob diff --git a/charts/fleet/102.2.0+up0.8.0/charts/gitjob/values.yaml b/charts/fleet/102.2.0+up0.8.0/charts/gitjob/values.yaml new file mode 100644 index 000000000..a535c75db --- /dev/null +++ b/charts/fleet/102.2.0+up0.8.0/charts/gitjob/values.yaml @@ -0,0 +1,31 @@ +gitjob: + repository: rancher/gitjob + tag: v0.1.76 + +tekton: + repository: rancher/tekton-utils + tag: v0.1.33 + +global: + cattle: + systemDefaultRegistry: "" + +# http[s] proxy server +# proxy: http://@:: + +# comma separated list of domains or ip addresses that will not use the proxy +noProxy: 127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.cluster.local + +nodeSelector: + kubernetes.io/os: linux + +tolerations: + - key: cattle.io/os + operator: "Equal" + value: "linux" + effect: NoSchedule + +# PriorityClassName assigned to deployment. +priorityClassName: "" + +debug: false diff --git a/charts/fleet/102.2.0+up0.8.0/templates/_helpers.tpl b/charts/fleet/102.2.0+up0.8.0/templates/_helpers.tpl new file mode 100644 index 000000000..6cd96c3ac --- /dev/null +++ b/charts/fleet/102.2.0+up0.8.0/templates/_helpers.tpl @@ -0,0 +1,22 @@ +{{- define "system_default_registry" -}} +{{- if .Values.global.cattle.systemDefaultRegistry -}} +{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}} +{{- else -}} +{{- "" -}} +{{- end -}} +{{- end -}} + +{{/* +Windows cluster will add default taint for linux nodes, +add below linux tolerations to workloads could be scheduled to those linux nodes +*/}} +{{- define "linux-node-tolerations" -}} +- key: "cattle.io/os" + value: "linux" + effect: "NoSchedule" + operator: "Equal" +{{- end -}} + +{{- define "linux-node-selector" -}} +kubernetes.io/os: linux +{{- end -}} \ No newline at end of file diff --git a/charts/fleet/102.2.0+up0.8.0/templates/configmap.yaml b/charts/fleet/102.2.0+up0.8.0/templates/configmap.yaml new file mode 100644 index 000000000..07f1b5924 --- /dev/null +++ b/charts/fleet/102.2.0+up0.8.0/templates/configmap.yaml @@ -0,0 +1,25 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: fleet-controller +data: + config: | + { + "systemDefaultRegistry": "{{ template "system_default_registry" . }}", + "agentImage": "{{ template "system_default_registry" . }}{{.Values.agentImage.repository}}:{{.Values.agentImage.tag}}", + "agentImagePullPolicy": "{{ .Values.agentImage.imagePullPolicy }}", + "apiServerURL": "{{.Values.apiServerURL}}", + "apiServerCA": "{{b64enc .Values.apiServerCA}}", + "agentCheckinInterval": "{{.Values.agentCheckinInterval}}", + "ignoreClusterRegistrationLabels": {{.Values.ignoreClusterRegistrationLabels}}, + "bootstrap": { + "paths": "{{.Values.bootstrap.paths}}", + "repo": "{{.Values.bootstrap.repo}}", + "secret": "{{.Values.bootstrap.secret}}", + "branch": "{{.Values.bootstrap.branch}}", + "namespace": "{{.Values.bootstrap.namespace}}", + "agentNamespace": "{{.Values.bootstrap.agentNamespace}}", + }, + "webhookReceiverURL": "{{.Values.webhookReceiverURL}}", + "githubURLPrefix": "{{.Values.githubURLPrefix}}" + } diff --git a/charts/fleet/102.2.0+up0.8.0/templates/deployment.yaml b/charts/fleet/102.2.0+up0.8.0/templates/deployment.yaml new file mode 100644 index 000000000..164340c44 --- /dev/null +++ b/charts/fleet/102.2.0+up0.8.0/templates/deployment.yaml @@ -0,0 +1,102 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: fleet-controller +spec: + selector: + matchLabels: + app: fleet-controller + template: + metadata: + labels: + app: fleet-controller + spec: + containers: + - env: + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: FLEET_PROPAGATE_DEBUG_SETTINGS_TO_AGENTS + value: {{ quote .Values.propagateDebugSettingsToAgents }} + {{- if .Values.clusterEnqueueDelay }} + - name: FLEET_CLUSTER_ENQUEUE_DELAY + value: {{ .Values.clusterEnqueueDelay }} + {{- end }} + {{- if .Values.proxy }} + - name: HTTP_PROXY + value: {{ .Values.proxy }} + - name: HTTPS_PROXY + value: {{ .Values.proxy }} + - name: NO_PROXY + value: {{ .Values.noProxy }} + {{- end }} + {{- if .Values.cpuPprof }} + - name: FLEET_CPU_PPROF_DIR + value: /tmp/pprof/ + {{- end }} + {{- if .Values.cpuPprof }} + - name: FLEET_CPU_PPROF_PERIOD + value: {{ quote .Values.cpuPprof.period }} + {{- end }} + {{- if .Values.debug }} + - name: CATTLE_DEV_MODE + value: "true" + {{- end }} + image: '{{ template "system_default_registry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag }}' + name: fleet-controller + imagePullPolicy: "{{ .Values.image.imagePullPolicy }}" + command: + - fleetcontroller + {{- if not .Values.gitops.enabled }} + - --disable-gitops + {{- end }} + {{- if not .Values.bootstrap.enabled }} + - --disable-bootstrap + {{- end }} + {{- if .Values.debug }} + - --debug + - --debug-level + - {{ quote .Values.debugLevel }} + {{- else }} + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + privileged: false + capabilities: + drop: + - ALL + {{- end }} + volumeMounts: + - mountPath: /tmp + name: tmp + {{- if .Values.cpuPprof }} + - mountPath: /tmp/pprof + name: pprof + {{- end }} + volumes: + - name: tmp + emptyDir: {} + {{- if .Values.cpuPprof }} + - name: pprof {{ toYaml .Values.cpuPprof.volumeConfiguration | nindent 10 }} + {{- end }} + + serviceAccountName: fleet-controller + nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} +{{- if .Values.nodeSelector }} +{{ toYaml .Values.nodeSelector | indent 8 }} +{{- end }} + tolerations: {{ include "linux-node-tolerations" . | nindent 8 }} +{{- if .Values.tolerations }} +{{ toYaml .Values.tolerations | indent 8 }} +{{- end }} + {{- if .Values.priorityClassName }} + priorityClassName: "{{.Values.priorityClassName}}" + {{- end }} + +{{- if not .Values.debug }} + securityContext: + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 1000 +{{- end }} diff --git a/charts/fleet/102.2.0+up0.8.0/templates/job_cleanup_clusterregistrations.yaml b/charts/fleet/102.2.0+up0.8.0/templates/job_cleanup_clusterregistrations.yaml new file mode 100644 index 000000000..fa59cc575 --- /dev/null +++ b/charts/fleet/102.2.0+up0.8.0/templates/job_cleanup_clusterregistrations.yaml @@ -0,0 +1,29 @@ +{{- if .Values.migrations.clusterRegistrationCleanup }} +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: fleet-cleanup-clusterregistrations + annotations: + "helm.sh/hook": post-install, post-upgrade + "helm.sh/hook-delete-policy": hook-succeeded, before-hook-creation +spec: + template: + metadata: + labels: + app: fleet-job + spec: + serviceAccountName: fleet-controller + restartPolicy: Never + containers: + - name: cleanup + image: "{{ template "system_default_registry" . }}{{.Values.agentImage.repository}}:{{.Values.agentImage.tag}}" + imagePullPolicy: {{ .Values.global.imagePullPolicy }} + command: + - fleet + args: + - cleanup + nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} + tolerations: {{ include "linux-node-tolerations" . | nindent 8 }} + backoffLimit: 1 +{{- end }} diff --git a/charts/fleet/102.2.0+up0.8.0/templates/rbac.yaml b/charts/fleet/102.2.0+up0.8.0/templates/rbac.yaml new file mode 100644 index 000000000..361d68c08 --- /dev/null +++ b/charts/fleet/102.2.0+up0.8.0/templates/rbac.yaml @@ -0,0 +1,114 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: fleet-controller +rules: +- apiGroups: + - gitjob.cattle.io + resources: + - '*' + verbs: + - '*' +- apiGroups: + - fleet.cattle.io + resources: + - '*' + verbs: + - '*' +- apiGroups: + - "" + resources: + - namespaces + - serviceaccounts + verbs: + - '*' +- apiGroups: + - "" + resources: + - secrets + - configmaps + verbs: + - '*' +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + - clusterrolebindings + - roles + - rolebindings + verbs: + - '*' + +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: fleet-controller +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: fleet-controller +subjects: +- kind: ServiceAccount + name: fleet-controller + namespace: {{.Release.Namespace}} + +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: fleet-controller +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - '*' +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - '*' + +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: fleet-controller +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: fleet-controller +subjects: +- kind: ServiceAccount + name: fleet-controller + +{{- if .Values.bootstrap.enabled }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: fleet-controller-bootstrap +rules: +- apiGroups: + - '*' + resources: + - '*' + verbs: + - '*' +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: fleet-controller-bootstrap +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: fleet-controller-bootstrap +subjects: +- kind: ServiceAccount + name: fleet-controller-bootstrap + namespace: {{.Release.Namespace}} +{{- end }} diff --git a/charts/fleet/102.2.0+up0.8.0/templates/serviceaccount.yaml b/charts/fleet/102.2.0+up0.8.0/templates/serviceaccount.yaml new file mode 100644 index 000000000..ba27c748d --- /dev/null +++ b/charts/fleet/102.2.0+up0.8.0/templates/serviceaccount.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: fleet-controller + +{{- if .Values.bootstrap.enabled }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: fleet-controller-bootstrap +{{- end }} diff --git a/charts/fleet/102.2.0+up0.8.0/values.yaml b/charts/fleet/102.2.0+up0.8.0/values.yaml new file mode 100644 index 000000000..2a0917851 --- /dev/null +++ b/charts/fleet/102.2.0+up0.8.0/values.yaml @@ -0,0 +1,83 @@ +image: + repository: rancher/fleet + tag: v0.8.0 + imagePullPolicy: IfNotPresent + +agentImage: + repository: rancher/fleet-agent + tag: v0.8.0 + imagePullPolicy: IfNotPresent + +# For cluster registration the public URL of the Kubernetes API server must be set here +# Example: https://example.com:6443 +apiServerURL: "" + +# For cluster registration the pem encoded value of the CA of the Kubernetes API server must be set here +# If left empty it is assumed this Kubernetes API TLS is signed by a well known CA. +apiServerCA: "" + +# A duration string for how often agents should report a heartbeat +agentCheckinInterval: "15m" + +# Whether you want to allow cluster upon registration to specify their labels. +ignoreClusterRegistrationLabels: false + +# Counts from gitrepo are out of sync with bundleDeployment state. +# Just retry in a number of seconds as there is no great way to trigger an event that doesn't cause a loop. +# If not set default is 15 seconds. +# clusterEnqueueDelay: 120s + +# http[s] proxy server +# proxy: http://@:: + +# comma separated list of domains or ip addresses that will not use the proxy +noProxy: 127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.cluster.local + +bootstrap: + enabled: true + # The namespace that will be autocreated and the local cluster will be registered in + namespace: fleet-local + # The namespace where the fleet agent for the local cluster will be ran, if empty + # this will default to cattle-fleet-system + agentNamespace: "" + # A repo to add at install time that will deploy to the local cluster. This allows + # one to fully bootstrap fleet, its configuration and all its downstream clusters + # in one shot. + repo: "" + secret: "" + branch: master + paths: "" + + +global: + cattle: + systemDefaultRegistry: "" + +## Node labels for pod assignment +## Ref: https://kubernetes.io/docs/user-guide/node-selection/ +## +nodeSelector: {} +## List of node taints to tolerate (requires Kubernetes >= 1.6) +tolerations: [] + +## PriorityClassName assigned to deployment. +priorityClassName: "" + +gitops: + enabled: true + +debug: false +debugLevel: 0 +propagateDebugSettingsToAgents: true + +## Optional CPU pprof configuration. Profiles are collected continuously and saved every period +## Any valid volume configuration can be provided, the example below uses hostPath +#cpuPprof: +# period: "60s" +# volumeConfiguration: +# hostPath: +# path: /tmp/pprof +# type: DirectoryOrCreate + +migrations: + clusterRegistrationCleanup: true diff --git a/charts/prometheus-federator/0.3.0+up0.3.3/Chart.yaml b/charts/prometheus-federator/0.3.0+up0.3.3/Chart.yaml new file mode 100644 index 000000000..3b9594cc8 --- /dev/null +++ b/charts/prometheus-federator/0.3.0+up0.3.3/Chart.yaml @@ -0,0 +1,20 @@ +annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/display-name: Prometheus Federator + catalog.cattle.io/kube-version: '>= 1.16.0-0 < 1.25.0-0' + catalog.cattle.io/namespace: cattle-monitoring-system + catalog.cattle.io/os: linux,windows + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/provides-gvr: helm.cattle.io.projecthelmchart/v1alpha1 + catalog.cattle.io/rancher-version: '>= 2.6.5-0 < 2.7.0-0' + catalog.cattle.io/release-name: prometheus-federator +apiVersion: v2 +appVersion: 0.3.2 +dependencies: +- condition: helmProjectOperator.enabled + name: helmProjectOperator + repository: file://./charts/helmProjectOperator +description: Prometheus Federator +icon: https://raw.githubusercontent.com/rancher/prometheus-federator/main/assets/logos/prometheus-federator.svg +name: prometheus-federator +version: 0.3.0+up0.3.3 diff --git a/charts/prometheus-federator/0.3.0+up0.3.3/README.md b/charts/prometheus-federator/0.3.0+up0.3.3/README.md new file mode 100644 index 000000000..7da4edfc2 --- /dev/null +++ b/charts/prometheus-federator/0.3.0+up0.3.3/README.md @@ -0,0 +1,120 @@ +# Prometheus Federator + +This chart is deploys a Helm Project Operator (based on the [rancher/helm-project-operator](https://github.com/rancher/helm-project-operator)), an operator that manages deploying Helm charts each containing a Project Monitoring Stack, where each stack contains: +- [Prometheus](https://prometheus.io/) (managed externally by [Prometheus Operator](https://github.com/prometheus-operator/prometheus-operator)) +- [Alertmanager](https://prometheus.io/docs/alerting/latest/alertmanager/) (managed externally by [Prometheus Operator](https://github.com/prometheus-operator/prometheus-operator)) +- [Grafana](https://github.com/helm/charts/tree/master/stable/grafana) (deployed via an embedded Helm chart) +- Default PrometheusRules and Grafana dashboards based on the collection of community-curated resources from [kube-prometheus](https://github.com/prometheus-operator/kube-prometheus/) +- Default ServiceMonitors that watch the deployed resources + +> **Important Note: Prometheus Federator is designed to be deployed alongside an existing Prometheus Operator deployment in a cluster that has already installed the Prometheus Operator CRDs.** + +By default, the chart is configured and intended to be deployed alongside [rancher-monitoring](https://rancher.com/docs/rancher/v2.6/en/monitoring-alerting/), which deploys Prometheus Operator alongside a Cluster Prometheus that each Project Monitoring Stack is configured to federate namespace-scoped metrics from by default. + +## Pre-Installation: Using Prometheus Federator with Rancher and rancher-monitoring + +If you are running your cluster on [Rancher](https://rancher.com/) and already have [rancher-monitoring](https://rancher.com/docs/rancher/v2.6/en/monitoring-alerting/) deployed onto your cluster, Prometheus Federator's default configuration should already be configured to work with your existing Cluster Monitoring Stack; however, here are some notes on how we recommend you configure rancher-monitoring to optimize the security and usability of Prometheus Federator in your cluster: + +### Ensure the cattle-monitoring-system namespace is placed into the System Project (or a similarly locked down Project that has access to other Projects in the cluster) + +Prometheus Operator's security model expects that the namespace it is deployed into (`cattle-monitoring-system`) has limited access for anyone except Cluster Admins to avoid privilege escalation via execing into Pods (such as the Jobs executing Helm operations). In addition, deploying Prometheus Federator and all Project Prometheus stacks into the System Project ensures that the each Project Prometheus is able to reach out to scrape workloads across all Projects (even if Network Policies are defined via Project Network Isolation) but has limited access for Project Owners, Project Members, and other users to be able to access data they shouldn't have access to (i.e. being allowed to exec into pods, set up the ability to scrape namespaces outside of a given Project, etc.). + +### Configure rancher-monitoring to only watch for resources created by the Helm chart itself + +Since each Project Monitoring Stack will watch the other namespaces and collect additional custom workload metrics or dashboards already, it's recommended to configure the following settings on all selectors to ensure that the Cluster Prometheus Stack only monitors resources created by the Helm Chart itself: + +``` +matchLabels: + release: "rancher-monitoring" +``` + +The following selector fields are recommended to have this value: +- `.Values.alertmanager.alertmanagerSpec.alertmanagerConfigSelector` +- `.Values.prometheus.prometheusSpec.serviceMonitorSelector` +- `.Values.prometheus.prometheusSpec.podMonitorSelector` +- `.Values.prometheus.prometheusSpec.ruleSelector` +- `.Values.prometheus.prometheusSpec.probeSelector` + +Once this setting is turned on, you can always create ServiceMonitors or PodMonitors that are picked up by the Cluster Prometheus by adding the label `release: "rancher-monitoring"` to them (in which case they will be ignored by Project Monitoring Stacks automatically by default, even if the namespace in which those ServiceMonitors or PodMonitors reside in are not system namespaces). + +> Note: If you don't want to allow users to be able to create ServiceMonitors and PodMonitors that aggregate into the Cluster Prometheus in Project namespaces, you can additionally set the namespaceSelectors on the chart to only target system namespaces (which must contain `cattle-monitoring-system` and `cattle-dashboards`, where resources are deployed into by default by rancher-monitoring; you will also need to monitor the `default` namespace to get apiserver metrics or create a custom ServiceMonitor to scrape apiserver metrics from the Service residing in the default namespace) to limit your Cluster Prometheus from picking up other Prometheus Operator CRs; in that case, it would be recommended to turn `.Values.prometheus.prometheusSpec.ignoreNamespaceSelectors=true` to allow you to define ServiceMonitors that can monitor non-system namespaces from within a system namespace. + +In addition, if you modified the default `.Values.grafana.sidecar.*.searchNamespace` values on the Grafana Helm subchart for Monitoring V2, it is also recommended to remove the overrides or ensure that your defaults are scoped to only system namespaces for the following values: +- `.Values.grafana.sidecar.dashboards.searchNamespace` (default `cattle-dashboards`) +- `.Values.grafana.sidecar.datasources.searchNamespace` (default `null`, which means it uses the release namespace `cattle-monitoring-system`) +- `.Values.grafana.sidecar.plugins.searchNamespace` (default `null`, which means it uses the release namespace `cattle-monitoring-system`) +- `.Values.grafana.sidecar.notifiers.searchNamespace` (default `null`, which means it uses the release namespace `cattle-monitoring-system`) + +### Increase the CPU / memory limits of the Cluster Prometheus + +Depending on a cluster's setup, it's generally recommended to give a large amount of dedicated memory to the Cluster Prometheus to avoid restarts due to out-of-memory errors (OOMKilled), usually caused by churn created in the cluster that causes a large number of high cardinality metrics to be generated and ingested by Prometheus within one block of time; this is one of the reasons why the default Rancher Monitoring stack expects around 4GB of RAM to be able to operate in a normal-sized cluster. However, when introducing Project Monitoring Stacks that are all sending `/federate` requests to the same Cluster Prometheus and are reliant on the Cluster Prometheus being "up" to federate that system data on their namespaces, it's even more important that the Cluster Prometheus has an ample amount of CPU / memory assigned to it to prevent an outage that can cause data gaps across all Project Prometheis in the cluster. + +> Note: There are no specific recommendations on how much memory the Cluster Prometheus should be configured with since it depends entirely on the user's setup (namely the likelihood of encountering a high churn rate and the scale of metrics that could be generated at that time); it generally varies per setup. + +## How does the operator work? + +1. On deploying this chart, users can create ProjectHelmCharts CRs with `spec.helmApiVersion` set to `monitoring.cattle.io/v1alpha1` (also known as "Project Monitors" in the Rancher UI) in a **Project Registration Namespace (`cattle-project-`)**. +2. On seeing each ProjectHelmChartCR, the operator will automatically deploy a Project Prometheus stack on the Project Owner's behalf in the **Project Release Namespace (`cattle-project--monitoring`)** based on a HelmChart CR and a HelmRelease CR automatically created by the ProjectHelmChart controller in the **Operator / System Namespace**. +3. RBAC will automatically be assigned in the Project Release Namespace to allow users to view the Prometheus, Alertmanager, and Grafana UIs of the Project Monitoring Stack deployed; this will be based on RBAC defined on the Project Registration Namespace against the [default Kubernetes user-facing roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles) (see below for more information about configuring RBAC). + +### What is a Project? + +In Prometheus Federator, a Project is a group of namespaces that can be identified by a `metav1.LabelSelector`; by default, the label used to identify projects is `field.cattle.io/projectId`, the label used to identify namespaces that are contained within a given [Rancher](https://rancher.com/) Project. + +### Configuring the Helm release created by a ProjectHelmChart + +The `spec.values` of this ProjectHelmChart resources will correspond to the `values.yaml` override to be supplied to the underlying Helm chart deployed by the operator on the user's behalf; to see the underlying chart's `values.yaml` spec, either: +- View to the chart's definition located at [`rancher/prometheus-federator` under `charts/rancher-project-monitoring`](https://github.com/rancher/prometheus-federator/blob/main/charts/rancher-project-monitoring) (where the chart version will be tied to the version of this operator) +- Look for the ConfigMap named `monitoring.cattle.io.v1alpha1` that is automatically created in each Project Registration Namespace, which will contain both the `values.yaml` and `questions.yaml` that was used to configure the chart (which was embedded directly into the `prometheus-federator` binary). + +### Namespaces + +As a Project Operator based on [rancher/helm-project-operator](https://github.com/rancher/helm-project-operator), Prometheus Federator has three different classifications of namespaces that the operator looks out for: +1. **Operator / System Namespace**: this is the namespace that the operator is deployed into (e.g. `cattle-monitoring-system`). This namespace will contain all HelmCharts and HelmReleases for all ProjectHelmCharts watched by this operator. **Only Cluster Admins should have access to this namespace.** +2. **Project Registration Namespace (`cattle-project-`)**: this is the set of namespaces that the operator watches for ProjectHelmCharts within. The RoleBindings and ClusterRoleBindings that apply to this namespace will also be the source of truth for the auto-assigned RBAC created in the Project Release Namespace (see more details below). **Project Owners (admin), Project Members (edit), and Read-Only Members (view) should have access to this namespace**. +> Note: Project Registration Namespaces will be auto-generated by the operator and imported into the Project it is tied to if `.Values.global.cattle.projectLabel` is provided (which is set to `field.cattle.io/projectId` by default); this indicates that a Project Registration Namespace should be created by the operator if at least one namespace is observed with that label. The operator will not let these namespaces be deleted unless either all namespaces with that label are gone (e.g. this is the last namespace in that project, in which case the namespace will be marked with the label `"helm.cattle.io/helm-project-operator-orphaned": "true"`, which signals that it can be deleted) or it is no longer watching that project (because the project ID was provided under `.Values.helmProjectOperator.otherSystemProjectLabelValues`, which serves as a denylist for Projects). These namespaces will also never be auto-deleted to avoid destroying user data; it is recommended that users clean up these namespaces manually if desired on creating or deleting a project +> Note: if `.Values.global.cattle.projectLabel` is not provided, the Operator / System Namespace will also be the Project Registration Namespace +3. **Project Release Namespace (`cattle-project--monitoring`)**: this is the set of namespaces that the operator deploys Project Monitoring Stacks within on behalf of a ProjectHelmChart; the operator will also automatically assign RBAC to Roles created in this namespace by the Project Monitoring Stack based on bindings found in the Project Registration Namespace. **Only Cluster Admins should have access to this namespace; Project Owners (admin), Project Members (edit), and Read-Only Members (view) will be assigned limited access to this namespace by the deployed Helm Chart and Prometheus Federator.** +> Note: Project Release Namespaces are automatically deployed and imported into the project whose ID is specified under `.Values.helmProjectOperator.projectReleaseNamespaces.labelValue` (which defaults to the value of `.Values.global.cattle.systemProjectId` if not specified) whenever a ProjectHelmChart is specified in a Project Registration Namespace +> Note: Project Release Namespaces follow the same orphaning conventions as Project Registration Namespaces (see note above) +> Note: if `.Values.projectReleaseNamespaces.enabled` is false, the Project Release Namespace will be the same as the Project Registration Namespace + +### Helm Resources (HelmChart, HelmRelease) + +On deploying a ProjectHelmChart, the Prometheus Federator will automatically create and manage two child custom resources that manage the underlying Helm resources in turn: +- A HelmChart CR (managed via an embedded [k3s-io/helm-contoller](https://github.com/k3s-io/helm-controller) in the operator): this custom resource automatically creates a Job in the same namespace that triggers a `helm install`, `helm upgrade`, or `helm uninstall` depending on the change applied to the HelmChart CR; this CR is automatically updated on changes to the ProjectHelmChart (e.g. modifying the values.yaml) or changes to the underlying Project definition (e.g. adding or removing namespaces from a project). +> **Important Note: If a ProjectHelmChart is not deploying or updating the underlying Project Monitoring Stack for some reason, the Job created by this resource in the Operator / System namespace should be the first place you check to see if there's something wrong with the Helm operation; however, this is generally only accessible by a Cluster Admin.** +- A HelmRelease CR (managed via an embedded [rancher/helm-locker](https://github.com/rancher/helm-locker) in the operator): this custom resource automatically locks a deployed Helm release in place and automatically overwrites updates to underlying resources unless the change happens via a Helm operation (`helm install`, `helm upgrade`, or `helm uninstall` performed by the HelmChart CR). +> Note: HelmRelease CRs emit Kubernetes Events that detect when an underlying Helm release is being modified and locks it back to place; to view these events, you can use `kubectl describe helmrelease -n `; you can also view the logs on this operator to see when changes are detected and which resources were attempted to be modified + +Both of these resources are created for all Helm charts in the Operator / System namespaces to avoid escalation of privileges to underprivileged users. + +### RBAC + +As described in the section on namespaces above, Prometheus Federator expects that Project Owners, Project Members, and other users in the cluster with Project-level permissions (e.g. permissions in a certain set of namespaces identified by a single label selector) have minimal permissions in any namespaces except the Project Registration Namespace (which is imported into the project by default) and those that already comprise their projects. Therefore, in order to allow Project Owners to assign specific chart permissions to other users in their Project namespaces, the Helm Project Operator will automatically watch the following bindings: +- ClusterRoleBindings +- RoleBindings in the Project Release Namespace + +On observing a change to one of those types of bindings, the Helm Project Operator will check whether the `roleRef` that the the binding points to matches a ClusterRole with the name provided under `helmProjectOperator.releaseRoleBindings.clusterRoleRefs.admin`, `helmProjectOperator.releaseRoleBindings.clusterRoleRefs.edit`, or `helmProjectOperator.releaseRoleBindings.clusterRoleRefs.view`; by default, these roleRefs correspond will correspond to `admin`, `edit`, and `view` respectively, which are the [default Kubernetes user-facing roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles). + +> Note: for Rancher RBAC users, these [default Kubernetes user-facing roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles) directly correlate to the `Project Owner`, `Project Member`, and `Read-Only` default Project Role Templates. + +If the `roleRef` matches, the Helm Project Operator will filter the `subjects` of the binding for all Users and Groups and use that to automatically construct a RoleBinding for each Role in the Project Release Namespace with the same name as the role and the following labels: +- `helm.cattle.io/project-helm-chart-role: {{ .Release.Name }}` +- `helm.cattle.io/project-helm-chart-role-aggregate-from: ` + +By default, the `rancher-project-monitoring` (the underlying chart deployed by Prometheus Federator) creates three default Roles per Project Release Namespace that provide `admin`, `edit`, and `view` users to permissions to view the Prometheus, Alertmanager, and Grafana UIs of the Project Monitoring Stack to provide least privilege; however, if a Cluster Admin would like to assign additional permissions to certain users, they can either directly assign RoleBindings in the Project Release Namespace to certain users or created Roles with the above two labels on them to allow Project Owners to control assigning those RBAC roles to users in their Project Registration namespaces. + +### Advanced Helm Project Operator Configuration + +|Value|Configuration| +|---|---------------------------| +|`helmProjectOperator.valuesOverride`| Allows an Operator to override values that are set on each ProjectHelmChart deployment on an operator-level; user-provided options (specified on the `spec.values` of the ProjectHelmChart) are automatically overridden if operator-level values are provided. For an exmaple, see how the default value overrides `federate.targets` (note: when overriding list values like `federate.targets`, user-provided list values will **not** be concatenated) | +|`helmProjectOperator.projectReleaseNamespaces.labelValues`| The value of the Project that all Project Release Namespaces should be auto-imported into (via label and annotation). Not recommended to be overridden on a Rancher setup. | +|`helmProjectOperator.otherSystemProjectLabelValues`| Other namespaces that the operator should treat as a system namespace that should not be monitored. By default, all namespaces that match `global.cattle.systemProjectId` will not be matched. `cattle-monitoring-system`, `cattle-dashboards`, and `kube-system` are explicitly marked as system namespaces as well, regardless of label or annotation. | +|`helmProjectOperator.releaseRoleBindings.aggregate`| Whether to automatically create RBAC resources in Project Release namespaces +|`helmProjectOperator.releaseRoleBindings.clusterRoleRefs.`| ClusterRoles to reference to discover subjects to create RoleBindings for in the Project Release Namespace for all corresponding Project Release Roles. See RBAC above for more information | +|`helmProjectOperator.hardenedNamespaces.enabled`| Whether to automatically patch the default ServiceAccount with `automountServiceAccountToken: false` and create a default NetworkPolicy in all managed namespaces in the cluster; the default values ensure that the creation of the namespace does not break a CIS 1.16 hardened scan | +|`helmProjectOperator.hardenedNamespaces.configuration`| The configuration to be supplied to the default ServiceAccount or auto-generated NetworkPolicy on managing a namespace | +|`helmProjectOperator.helmController.enabled`| Whether to enable an embedded k3s-io/helm-controller instance within the Helm Project Operator. Should be disabled for RKE2/K3s clusters before v1.23.14 / v1.24.8 / v1.25.4 since RKE2/K3s clusters already run Helm Controller at a cluster-wide level to manage internal Kubernetes components | +|`helmProjectOperator.helmLocker.enabled`| Whether to enable an embedded rancher/helm-locker instance within the Helm Project Operator. | diff --git a/charts/prometheus-federator/0.3.0+up0.3.3/app-README.md b/charts/prometheus-federator/0.3.0+up0.3.3/app-README.md new file mode 100644 index 000000000..cba87c6a8 --- /dev/null +++ b/charts/prometheus-federator/0.3.0+up0.3.3/app-README.md @@ -0,0 +1,10 @@ +# Prometheus Federator + +This chart deploys an operator that manages Project Monitoring Stacks composed of the following set of resources that are scoped to project namespaces: +- [Prometheus](https://prometheus.io/) (managed externally by [Prometheus Operator](https://github.com/prometheus-operator/prometheus-operator)) +- [Alertmanager](https://prometheus.io/docs/alerting/latest/alertmanager/) (managed externally by [Prometheus Operator](https://github.com/prometheus-operator/prometheus-operator)) +- [Grafana](https://github.com/helm/charts/tree/master/stable/grafana) (deployed via an embedded Helm chart) +- Default PrometheusRules and Grafana dashboards based on the collection of community-curated resources from [kube-prometheus](https://github.com/prometheus-operator/kube-prometheus/) +- Default ServiceMonitors that watch the deployed Prometheus, Grafana, and Alertmanager + +Since this Project Monitoring Stack deploys Prometheus Operator CRs, an existing Prometheus Operator instance must already be deployed in the cluster for Prometheus Federator to successfully be able to deploy Project Monitoring Stacks. It is recommended to use [`rancher-monitoring`](https://rancher.com/docs/rancher/v2.6/en/monitoring-alerting/) for this. For more information on how the chart works or advanced configurations, please read the `README.md`. diff --git a/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/Chart.yaml b/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/Chart.yaml new file mode 100644 index 000000000..f72ae6b20 --- /dev/null +++ b/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/Chart.yaml @@ -0,0 +1,15 @@ +annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/display-name: Helm Project Operator + catalog.cattle.io/kube-version: '>= 1.16.0-0 < 1.25.0-0' + catalog.cattle.io/namespace: cattle-helm-system + catalog.cattle.io/os: linux,windows + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/provides-gvr: helm.cattle.io.projecthelmchart/v1alpha1 + catalog.cattle.io/rancher-version: '>= 2.6.5-0 < 2.7.0-0' + catalog.cattle.io/release-name: helm-project-operator +apiVersion: v2 +appVersion: 0.2.1 +description: Helm Project Operator +name: helmProjectOperator +version: 0.2.1 diff --git a/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/README.md b/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/README.md new file mode 100644 index 000000000..fc1d39e81 --- /dev/null +++ b/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/README.md @@ -0,0 +1,77 @@ +# Helm Project Operator + +## How does the operator work? + +1. On deploying a Helm Project Operator, users can create ProjectHelmCharts CRs with `spec.helmApiVersion` set to `dummy.cattle.io/v1alpha1` in a **Project Registration Namespace (`cattle-project-`)**. +2. On seeing each ProjectHelmChartCR, the operator will automatically deploy the embedded Helm chart on the Project Owner's behalf in the **Project Release Namespace (`cattle-project--dummy`)** based on a HelmChart CR and a HelmRelease CR automatically created by the ProjectHelmChart controller in the **Operator / System Namespace**. +3. RBAC will automatically be assigned in the Project Release Namespace to allow users to based on Role created in the Project Release Namespace with a given set of labels; this will be based on RBAC defined on the Project Registration Namespace against the [default Kubernetes user-facing roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles) (see below for more information about configuring RBAC). + +### What is a Project? + +In Helm Project Operator, a Project is a group of namespaces that can be identified by a `metav1.LabelSelector`; by default, the label used to identify projects is `field.cattle.io/projectId`, the label used to identify namespaces that are contained within a given [Rancher](https://rancher.com/) Project. + +### What is a ProjectHelmChart? + +A ProjectHelmChart is an instance of a (project-scoped) Helm chart deployed on behalf of a user who has permissions to create ProjectHelmChart resources in a Project Registration namespace. + +Generally, the best way to think about the ProjectHelmChart model is by comparing it to two other models: +1. Managed Kubernetes providers (EKS, GKE, AKS, etc.): in this model, a user has the ability to say "I want a Kubernetes cluster" but the underlying cloud provider is responsible for provisioning the infrastructure and offering **limited view and access** of the underlying resources created on their behalf; similarly, Helm Project Operator allows a Project Owner to say "I want this Helm chart deployed", but the underlying Operator is responsible for "provisioning" (deploying) the Helm chart and offering **limited view and access** of the underlying Kubernetes resources created on their behalf (based on configuring "least-privilege" Kubernetes RBAC for the Project Owners / Members in the newly created Project Release Namespace). +2. Dynamically-provisioned Persistent Volumes: in this model, a single resource (PersistentVolume) exists that allows you to specify a Storage Class that actually implements provisioning the underlying storage via a Storage Class Provisioner (e.g. Longhorn). Similarly, the ProjectHelmChart exists that allows you to specify a `spec.helmApiVersion` ("storage class") that actually implements deploying the underlying Helm chart via a Helm Project Operator (e.g. [`rancher/prometheus-federator`](https://github.com/rancher/prometheus-federator)). + +### Configuring the Helm release created by a ProjectHelmChart + +The `spec.values` of this ProjectHelmChart resources will correspond to the `values.yaml` override to be supplied to the underlying Helm chart deployed by the operator on the user's behalf; to see the underlying chart's `values.yaml` spec, either: +- View to the chart's definition located at [`rancher/helm-project-operator` under `charts/example-chart`](https://github.com/rancher/helm-project-operator/blob/main/charts/example-chart) (where the chart version will be tied to the version of this operator) +- Look for the ConfigMap named `dummy.cattle.io.v1alpha1` that is automatically created in each Project Registration Namespace, which will contain both the `values.yaml` and `questions.yaml` that was used to configure the chart (which was embedded directly into the `helm-project-operator` binary). + +### Namespaces + +All Helm Project Operators have three different classifications of namespaces that the operator looks out for: +1. **Operator / System Namespace**: this is the namespace that the operator is deployed into (e.g. `cattle-helm-system`). This namespace will contain all HelmCharts and HelmReleases for all ProjectHelmCharts watched by this operator. **Only Cluster Admins should have access to this namespace.** +2. **Project Registration Namespace (`cattle-project-`)**: this is the set of namespaces that the operator watches for ProjectHelmCharts within. The RoleBindings and ClusterRoleBindings that apply to this namespace will also be the source of truth for the auto-assigned RBAC created in the Project Release Namespace (see more details below). **Project Owners (admin), Project Members (edit), and Read-Only Members (view) should have access to this namespace**. +> Note: Project Registration Namespaces will be auto-generated by the operator and imported into the Project it is tied to if `.Values.global.cattle.projectLabel` is provided (which is set to `field.cattle.io/projectId` by default); this indicates that a Project Registration Namespace should be created by the operator if at least one namespace is observed with that label. The operator will not let these namespaces be deleted unless either all namespaces with that label are gone (e.g. this is the last namespace in that project, in which case the namespace will be marked with the label `"helm.cattle.io/helm-project-operator-orphaned": "true"`, which signals that it can be deleted) or it is no longer watching that project (because the project ID was provided under `.Values.helmProjectOperator.otherSystemProjectLabelValues`, which serves as a denylist for Projects). These namespaces will also never be auto-deleted to avoid destroying user data; it is recommended that users clean up these namespaces manually if desired on creating or deleting a project +> Note: if `.Values.global.cattle.projectLabel` is not provided, the Operator / System Namespace will also be the Project Registration Namespace +3. **Project Release Namespace (`cattle-project--dummy`)**: this is the set of namespaces that the operator deploys Helm charts within on behalf of a ProjectHelmChart; the operator will also automatically assign RBAC to Roles created in this namespace by the Helm charts based on bindings found in the Project Registration Namespace. **Only Cluster Admins should have access to this namespace; Project Owners (admin), Project Members (edit), and Read-Only Members (view) will be assigned limited access to this namespace by the deployed Helm Chart and Helm Project Operator.** +> Note: Project Release Namespaces are automatically deployed and imported into the project whose ID is specified under `.Values.helmProjectOperator.projectReleaseNamespaces.labelValue` (which defaults to the value of `.Values.global.cattle.systemProjectId` if not specified) whenever a ProjectHelmChart is specified in a Project Registration Namespace +> Note: Project Release Namespaces follow the same orphaning conventions as Project Registration Namespaces (see note above) +> Note: if `.Values.projectReleaseNamespaces.enabled` is false, the Project Release Namespace will be the same as the Project Registration Namespace + +### Helm Resources (HelmChart, HelmRelease) + +On deploying a ProjectHelmChart, the Helm Project Operator will automatically create and manage two child custom resources that manage the underlying Helm resources in turn: +- A HelmChart CR (managed via an embedded [k3s-io/helm-contoller](https://github.com/k3s-io/helm-controller) in the operator): this custom resource automatically creates a Job in the same namespace that triggers a `helm install`, `helm upgrade`, or `helm uninstall` depending on the change applied to the HelmChart CR; this CR is automatically updated on changes to the ProjectHelmChart (e.g. modifying the values.yaml) or changes to the underlying Project definition (e.g. adding or removing namespaces from a project). +> **Important Note: If a ProjectHelmChart is not deploying or updating the underlying Project Monitoring Stack for some reason, the Job created by this resource in the Operator / System namespace should be the first place you check to see if there's something wrong with the Helm operation; however, this is generally only accessible by a Cluster Admin.** +- A HelmRelease CR (managed via an embedded [rancher/helm-locker](https://github.com/rancher/helm-locker) in the operator): this custom resource automatically locks a deployed Helm release in place and automatically overwrites updates to underlying resources unless the change happens via a Helm operation (`helm install`, `helm upgrade`, or `helm uninstall` performed by the HelmChart CR). +> Note: HelmRelease CRs emit Kubernetes Events that detect when an underlying Helm release is being modified and locks it back to place; to view these events, you can use `kubectl describe helmrelease -n `; you can also view the logs on this operator to see when changes are detected and which resources were attempted to be modified + +Both of these resources are created for all Helm charts in the Operator / System namespaces to avoid escalation of privileges to underprivileged users. + +### RBAC + +As described in the section on namespaces above, Helm Project Operator expects that Project Owners, Project Members, and other users in the cluster with Project-level permissions (e.g. permissions in a certain set of namespaces identified by a single label selector) have minimal permissions in any namespaces except the Project Registration Namespace (which is imported into the project by default) and those that already comprise their projects. Therefore, in order to allow Project Owners to assign specific chart permissions to other users in their Project namespaces, the Helm Project Operator will automatically watch the following bindings: +- ClusterRoleBindings +- RoleBindings in the Project Release Namespace + +On observing a change to one of those types of bindings, the Helm Project Operator will check whether the `roleRef` that the the binding points to matches a ClusterRole with the name provided under `helmProjectOperator.releaseRoleBindings.clusterRoleRefs.admin`, `helmProjectOperator.releaseRoleBindings.clusterRoleRefs.edit`, or `helmProjectOperator.releaseRoleBindings.clusterRoleRefs.view`; by default, these roleRefs correspond will correspond to `admin`, `edit`, and `view` respectively, which are the [default Kubernetes user-facing roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles). + +> Note: for Rancher RBAC users, these [default Kubernetes user-facing roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles) directly correlate to the `Project Owner`, `Project Member`, and `Read-Only` default Project Role Templates. + +If the `roleRef` matches, the Helm Project Operator will filter the `subjects` of the binding for all Users and Groups and use that to automatically construct a RoleBinding for each Role in the Project Release Namespace with the same name as the role and the following labels: +- `helm.cattle.io/project-helm-chart-role: {{ .Release.Name }}` +- `helm.cattle.io/project-helm-chart-role-aggregate-from: ` + +By default, the `example-chart` (the underlying chart deployed by Helm Project Operator) does not create any default roles; however, if a Cluster Admin would like to assign additional permissions to certain users, they can either directly assign RoleBindings in the Project Release Namespace to certain users or created Roles with the above two labels on them to allow Project Owners to control assigning those RBAC roles to users in their Project Registration namespaces. + +### Advanced Helm Project Operator Configuration + +|Value|Configuration| +|---|---------------------------| +|`valuesOverride`| Allows an Operator to override values that are set on each ProjectHelmChart deployment on an operator-level; user-provided options (specified on the `spec.values` of the ProjectHelmChart) are automatically overridden if operator-level values are provided. For an exmaple, see how the default value overrides `federate.targets` (note: when overriding list values like `federate.targets`, user-provided list values will **not** be concatenated) | +|`projectReleaseNamespaces.labelValues`| The value of the Project that all Project Release Namespaces should be auto-imported into (via label and annotation). Not recommended to be overridden on a Rancher setup. | +|`otherSystemProjectLabelValues`| Other namespaces that the operator should treat as a system namespace that should not be monitored. By default, all namespaces that match `global.cattle.systemProjectId` will not be matched. `kube-system` is explicitly marked as a system namespace as well, regardless of label or annotation. | +|`releaseRoleBindings.aggregate`| Whether to automatically create RBAC resources in Project Release namespaces +|`releaseRoleBindings.clusterRoleRefs.`| ClusterRoles to reference to discover subjects to create RoleBindings for in the Project Release Namespace for all corresponding Project Release Roles. See RBAC above for more information | +|`hardenedNamespaces.enabled`| Whether to automatically patch the default ServiceAccount with `automountServiceAccountToken: false` and create a default NetworkPolicy in all managed namespaces in the cluster; the default values ensure that the creation of the namespace does not break a CIS 1.16 hardened scan | +|`hardenedNamespaces.configuration`| The configuration to be supplied to the default ServiceAccount or auto-generated NetworkPolicy on managing a namespace | +|`helmController.enabled`| Whether to enable an embedded k3s-io/helm-controller instance within the Helm Project Operator. Should be disabled for RKE2 clusters since RKE2 clusters already run Helm Controller to manage internal Kubernetes components | +|`helmLocker.enabled`| Whether to enable an embedded rancher/helm-locker instance within the Helm Project Operator. | diff --git a/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/app-readme.md b/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/app-readme.md new file mode 100644 index 000000000..fd551467d --- /dev/null +++ b/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/app-readme.md @@ -0,0 +1,20 @@ +# Helm Project Operator + +This chart installs the example [Helm Project Operator](https://github.com/rancher/helm-project-operator) onto your cluster. + +## Upgrading to Kubernetes v1.25+ + +Starting in Kubernetes v1.25, [Pod Security Policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/) have been removed from the Kubernetes API. + +As a result, **before upgrading to Kubernetes v1.25** (or on a fresh install in a Kubernetes v1.25+ cluster), users are expected to perform an in-place upgrade of this chart with `global.cattle.psp.enabled` set to `false` if it has been previously set to `true`. +​ +> **Note:** +> In this chart release, any previous field that was associated with any PSP resources have been removed in favor of a single global field: `global.cattle.psp.enabled`. + ​ +> **Note:** +> If you upgrade your cluster to Kubernetes v1.25+ before removing PSPs via a `helm upgrade` (even if you manually clean up resources), **it will leave the Helm release in a broken state within the cluster such that further Helm operations will not work (`helm uninstall`, `helm upgrade`, etc.).** +> +> If your charts get stuck in this state, please consult the Rancher docs on how to clean up your Helm release secrets. +Upon setting `global.cattle.psp.enabled` to false, the chart will remove any PSP resources deployed on its behalf from the cluster. This is the default setting for this chart. +​ +As a replacement for PSPs, [Pod Security Admission](https://kubernetes.io/docs/concepts/security/pod-security-admission/) should be used. Please consult the Rancher docs for more details on how to configure your chart release namespaces to work with the new Pod Security Admission and apply Pod Security Standards. \ No newline at end of file diff --git a/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/questions.yaml b/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/questions.yaml new file mode 100644 index 000000000..054361a7a --- /dev/null +++ b/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/questions.yaml @@ -0,0 +1,43 @@ +questions: +- variable: global.cattle.psp.enabled + default: "false" + description: "Flag to enable or disable the installation of PodSecurityPolicies by this chart in the target cluster. If the cluster is running Kubernetes 1.25+, you must update this value to false." + label: "Enable PodSecurityPolicies" + type: boolean + group: "Security Settings" +- variable: helmController.enabled + label: Enable Embedded Helm Controller + description: 'Note: If you are running this chart in an RKE2 cluster, this should be disabled.' + type: boolean + group: Helm Controller +- variable: helmLocker.enabled + label: Enable Embedded Helm Locker + type: boolean + group: Helm Locker +- variable: projectReleaseNamespaces.labelValue + label: Project Release Namespace Project ID + description: By default, the System Project is selected. This can be overriden to a different Project (e.g. p-xxxxx) + type: string + required: false + group: Namespaces +- variable: releaseRoleBindings.clusterRoleRefs.admin + label: Admin ClusterRole + description: By default, admin selects Project Owners. This can be overridden to a different ClusterRole (e.g. rt-xxxxx) + type: string + default: admin + required: false + group: RBAC +- variable: releaseRoleBindings.clusterRoleRefs.edit + label: Edit ClusterRole + description: By default, edit selects Project Members. This can be overridden to a different ClusterRole (e.g. rt-xxxxx) + type: string + default: edit + required: false + group: RBAC +- variable: releaseRoleBindings.clusterRoleRefs.view + label: View ClusterRole + description: By default, view selects Read-Only users. This can be overridden to a different ClusterRole (e.g. rt-xxxxx) + type: string + default: view + required: false + group: RBAC diff --git a/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/templates/NOTES.txt b/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/templates/NOTES.txt new file mode 100644 index 000000000..32baeebcb --- /dev/null +++ b/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/templates/NOTES.txt @@ -0,0 +1,2 @@ +{{ $.Chart.Name }} has been installed. Check its status by running: + kubectl --namespace {{ template "helm-project-operator.namespace" . }} get pods -l "release={{ $.Release.Name }}" diff --git a/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/templates/_helpers.tpl b/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/templates/_helpers.tpl new file mode 100644 index 000000000..97dd6b368 --- /dev/null +++ b/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/templates/_helpers.tpl @@ -0,0 +1,66 @@ +# Rancher +{{- define "system_default_registry" -}} +{{- if .Values.global.cattle.systemDefaultRegistry -}} +{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}} +{{- end -}} +{{- end -}} + +# Windows Support + +{{/* +Windows cluster will add default taint for linux nodes, +add below linux tolerations to workloads could be scheduled to those linux nodes +*/}} + +{{- define "linux-node-tolerations" -}} +- key: "cattle.io/os" + value: "linux" + effect: "NoSchedule" + operator: "Equal" +{{- end -}} + +{{- define "linux-node-selector" -}} +{{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}} +beta.kubernetes.io/os: linux +{{- else -}} +kubernetes.io/os: linux +{{- end -}} +{{- end -}} + +# Helm Project Operator + +{{/* vim: set filetype=mustache: */}} +{{/* Expand the name of the chart. This is suffixed with -alertmanager, which means subtract 13 from longest 63 available */}} +{{- define "helm-project-operator.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 50 | trimSuffix "-" -}} +{{- end }} + +{{/* +Allow the release namespace to be overridden for multi-namespace deployments in combined charts +*/}} +{{- define "helm-project-operator.namespace" -}} + {{- if .Values.namespaceOverride -}} + {{- .Values.namespaceOverride -}} + {{- else -}} + {{- .Release.Namespace -}} + {{- end -}} +{{- end -}} + +{{/* Create chart name and version as used by the chart label. */}} +{{- define "helm-project-operator.chartref" -}} +{{- replace "+" "_" .Chart.Version | printf "%s-%s" .Chart.Name -}} +{{- end }} + +{{/* Generate basic labels */}} +{{- define "helm-project-operator.labels" -}} +app.kubernetes.io/managed-by: {{ .Release.Service }} +app.kubernetes.io/instance: {{ .Release.Name }} +app.kubernetes.io/version: "{{ replace "+" "_" .Chart.Version }}" +app.kubernetes.io/part-of: {{ template "helm-project-operator.name" . }} +chart: {{ template "helm-project-operator.chartref" . }} +release: {{ $.Release.Name | quote }} +heritage: {{ $.Release.Service | quote }} +{{- if .Values.commonLabels}} +{{ toYaml .Values.commonLabels }} +{{- end }} +{{- end -}} diff --git a/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/templates/cleanup.yaml b/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/templates/cleanup.yaml new file mode 100644 index 000000000..98675642d --- /dev/null +++ b/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/templates/cleanup.yaml @@ -0,0 +1,82 @@ +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ template "helm-project-operator.name" . }}-cleanup + namespace: {{ template "helm-project-operator.namespace" . }} + labels: {{ include "helm-project-operator.labels" . | nindent 4 }} + app: {{ template "helm-project-operator.name" . }} + annotations: + "helm.sh/hook": pre-delete + "helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed +spec: + template: + metadata: + name: {{ template "helm-project-operator.name" . }}-cleanup + labels: {{ include "helm-project-operator.labels" . | nindent 8 }} + app: {{ template "helm-project-operator.name" . }} + spec: + serviceAccountName: {{ template "helm-project-operator.name" . }} +{{- if .Values.cleanup.securityContext }} + securityContext: {{ toYaml .Values.cleanup.securityContext | nindent 8 }} +{{- end }} + initContainers: + - name: add-cleanup-annotations + image: {{ template "system_default_registry" . }}{{ .Values.cleanup.image.repository }}:{{ .Values.cleanup.image.tag }} + imagePullPolicy: "{{ .Values.image.pullPolicy }}" + command: + - /bin/sh + - -c + - > + echo "Labeling all ProjectHelmCharts with helm.cattle.io/helm-project-operator-cleanup=true"; + EXPECTED_HELM_API_VERSION={{ .Values.helmApiVersion }}; + IFS=$'\n'; + for namespace in $(kubectl get namespaces -l helm.cattle.io/helm-project-operated=true --no-headers -o=custom-columns=NAME:.metadata.name); do + for projectHelmChartAndHelmApiVersion in $(kubectl get projecthelmcharts -n ${namespace} --no-headers -o=custom-columns=NAME:.metadata.name,HELMAPIVERSION:.spec.helmApiVersion); do + projectHelmChartAndHelmApiVersion=$(echo ${projectHelmChartAndHelmApiVersion} | xargs); + projectHelmChart=$(echo ${projectHelmChartAndHelmApiVersion} | cut -d' ' -f1); + helmApiVersion=$(echo ${projectHelmChartAndHelmApiVersion} | cut -d' ' -f2); + if [[ ${helmApiVersion} != ${EXPECTED_HELM_API_VERSION} ]]; then + echo "Skipping marking ${namespace}/${projectHelmChart} with cleanup annotation since spec.helmApiVersion: ${helmApiVersion} is not ${EXPECTED_HELM_API_VERSION}"; + continue; + fi; + kubectl label projecthelmcharts -n ${namespace} ${projectHelmChart} helm.cattle.io/helm-project-operator-cleanup=true --overwrite; + done; + done; +{{- if .Values.cleanup.resources }} + resources: {{ toYaml .Values.cleanup.resources | nindent 12 }} +{{- end }} +{{- if .Values.cleanup.containerSecurityContext }} + securityContext: {{ toYaml .Values.cleanup.containerSecurityContext | nindent 12 }} +{{- end }} + containers: + - name: ensure-subresources-deleted + image: {{ template "system_default_registry" . }}{{ .Values.cleanup.image.repository }}:{{ .Values.cleanup.image.tag }} + imagePullPolicy: IfNotPresent + command: + - /bin/sh + - -c + - > + SYSTEM_NAMESPACE={{ .Release.Namespace }} + EXPECTED_HELM_API_VERSION={{ .Values.helmApiVersion }}; + HELM_API_VERSION_TRUNCATED=$(echo ${EXPECTED_HELM_API_VERSION} | cut -d'/' -f0); + echo "Ensuring HelmCharts and HelmReleases are deleted from ${SYSTEM_NAMESPACE}..."; + while [[ "$(kubectl get helmcharts,helmreleases -l helm.cattle.io/helm-api-version=${HELM_API_VERSION_TRUNCATED} -n ${SYSTEM_NAMESPACE} 2>&1)" != "No resources found in ${SYSTEM_NAMESPACE} namespace." ]]; do + echo "waiting for HelmCharts and HelmReleases to be deleted from ${SYSTEM_NAMESPACE}... sleeping 3 seconds"; + sleep 3; + done; + echo "Successfully deleted all HelmCharts and HelmReleases in ${SYSTEM_NAMESPACE}!"; +{{- if .Values.cleanup.resources }} + resources: {{ toYaml .Values.cleanup.resources | nindent 12 }} +{{- end }} +{{- if .Values.cleanup.containerSecurityContext }} + securityContext: {{ toYaml .Values.cleanup.containerSecurityContext | nindent 12 }} +{{- end }} + restartPolicy: OnFailure + nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} + {{- if .Values.cleanup.nodeSelector }} + {{- toYaml .Values.cleanup.nodeSelector | nindent 8 }} + {{- end }} + tolerations: {{ include "linux-node-tolerations" . | nindent 8 }} + {{- if .Values.cleanup.tolerations }} + {{- toYaml .Values.cleanup.tolerations | nindent 8 }} + {{- end }} diff --git a/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/templates/clusterrole.yaml b/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/templates/clusterrole.yaml new file mode 100644 index 000000000..60ed263ba --- /dev/null +++ b/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/templates/clusterrole.yaml @@ -0,0 +1,57 @@ +{{- if and .Values.global.rbac.create .Values.global.rbac.userRoles.create }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "helm-project-operator.name" . }}-admin + labels: {{ include "helm-project-operator.labels" . | nindent 4 }} + {{- if .Values.global.rbac.userRoles.aggregateToDefaultRoles }} + rbac.authorization.k8s.io/aggregate-to-admin: "true" + {{- end }} +rules: +- apiGroups: + - helm.cattle.io + resources: + - projecthelmcharts + - projecthelmcharts/finalizers + - projecthelmcharts/status + verbs: + - '*' +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "helm-project-operator.name" . }}-edit + labels: {{ include "helm-project-operator.labels" . | nindent 4 }} + {{- if .Values.global.rbac.userRoles.aggregateToDefaultRoles }} + rbac.authorization.k8s.io/aggregate-to-edit: "true" + {{- end }} +rules: +- apiGroups: + - helm.cattle.io + resources: + - projecthelmcharts + - projecthelmcharts/status + verbs: + - 'get' + - 'list' + - 'watch' +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "helm-project-operator.name" . }}-view + labels: {{ include "helm-project-operator.labels" . | nindent 4 }} + {{- if .Values.global.rbac.userRoles.aggregateToDefaultRoles }} + rbac.authorization.k8s.io/aggregate-to-view: "true" + {{- end }} +rules: +- apiGroups: + - helm.cattle.io + resources: + - projecthelmcharts + - projecthelmcharts/status + verbs: + - 'get' + - 'list' + - 'watch' +{{- end }} diff --git a/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/templates/configmap.yaml b/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/templates/configmap.yaml new file mode 100644 index 000000000..d4def157d --- /dev/null +++ b/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/templates/configmap.yaml @@ -0,0 +1,14 @@ +## Note: If you add another entry to this ConfigMap, make sure a corresponding env var is set +## in the deployment of the operator to ensure that a Helm upgrade will force the operator +## to reload the values in the ConfigMap and redeploy +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "helm-project-operator.name" . }}-config + namespace: {{ template "helm-project-operator.namespace" . }} + labels: {{ include "helm-project-operator.labels" . | nindent 4 }} +data: + hardened.yaml: |- +{{ .Values.hardenedNamespaces.configuration | toYaml | indent 4 }} + values.yaml: |- +{{ .Values.valuesOverride | toYaml | indent 4 }} diff --git a/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/templates/deployment.yaml b/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/templates/deployment.yaml new file mode 100644 index 000000000..33b81e72e --- /dev/null +++ b/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/templates/deployment.yaml @@ -0,0 +1,126 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ template "helm-project-operator.name" . }} + namespace: {{ template "helm-project-operator.namespace" . }} + labels: {{ include "helm-project-operator.labels" . | nindent 4 }} + app: {{ template "helm-project-operator.name" . }} +spec: + {{- if .Values.replicas }} + replicas: {{ .Values.replicas }} + {{- end }} + selector: + matchLabels: + app: {{ template "helm-project-operator.name" . }} + release: {{ $.Release.Name | quote }} + template: + metadata: + labels: {{ include "helm-project-operator.labels" . | nindent 8 }} + app: {{ template "helm-project-operator.name" . }} + spec: + containers: + - name: {{ template "helm-project-operator.name" . }} + image: "{{ template "system_default_registry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: "{{ .Values.image.pullPolicy }}" + args: + - {{ template "helm-project-operator.name" . }} + - --namespace={{ template "helm-project-operator.namespace" . }} + - --controller-name={{ template "helm-project-operator.name" . }} + - --values-override-file=/etc/helmprojectoperator/config/values.yaml +{{- if .Values.global.cattle.systemDefaultRegistry }} + - --system-default-registry={{ .Values.global.cattle.systemDefaultRegistry }} +{{- end }} +{{- if .Values.global.cattle.url }} + - --cattle-url={{ .Values.global.cattle.url }} +{{- end }} +{{- if .Values.global.cattle.projectLabel }} + - --project-label={{ .Values.global.cattle.projectLabel }} +{{- end }} +{{- if not .Values.projectReleaseNamespaces.enabled }} + - --system-project-label-values={{ join "," (append .Values.otherSystemProjectLabelValues .Values.global.cattle.systemProjectId) }} +{{- else if and (ne (len .Values.global.cattle.systemProjectId) 0) (ne (len .Values.projectReleaseNamespaces.labelValue) 0) (ne .Values.projectReleaseNamespaces.labelValue .Values.global.cattle.systemProjectId) }} + - --system-project-label-values={{ join "," (append .Values.otherSystemProjectLabelValues .Values.global.cattle.systemProjectId) }} +{{- else if len .Values.otherSystemProjectLabelValues }} + - --system-project-label-values={{ join "," .Values.otherSystemProjectLabelValues }} +{{- end }} +{{- if .Values.projectReleaseNamespaces.enabled }} +{{- if .Values.projectReleaseNamespaces.labelValue }} + - --project-release-label-value={{ .Values.projectReleaseNamespaces.labelValue }} +{{- else if .Values.global.cattle.systemProjectId }} + - --project-release-label-value={{ .Values.global.cattle.systemProjectId }} +{{- end }} +{{- end }} +{{- if .Values.global.cattle.clusterId }} + - --cluster-id={{ .Values.global.cattle.clusterId }} +{{- end }} +{{- if .Values.releaseRoleBindings.aggregate }} +{{- if .Values.releaseRoleBindings.clusterRoleRefs }} +{{- if .Values.releaseRoleBindings.clusterRoleRefs.admin }} + - --admin-cluster-role={{ .Values.releaseRoleBindings.clusterRoleRefs.admin }} +{{- end }} +{{- if .Values.releaseRoleBindings.clusterRoleRefs.edit }} + - --edit-cluster-role={{ .Values.releaseRoleBindings.clusterRoleRefs.edit }} +{{- end }} +{{- if .Values.releaseRoleBindings.clusterRoleRefs.view }} + - --view-cluster-role={{ .Values.releaseRoleBindings.clusterRoleRefs.view }} +{{- end }} +{{- end }} +{{- end }} +{{- if .Values.hardenedNamespaces.enabled }} + - --hardening-options-file=/etc/helmprojectoperator/config/hardening.yaml +{{- else }} + - --disable-hardening +{{- end }} +{{- if .Values.debug }} + - --debug + - --debug-level={{ .Values.debugLevel }} +{{- end }} +{{- if not .Values.helmController.enabled }} + - --disable-embedded-helm-controller +{{- else }} + - --helm-job-image={{ template "system_default_registry" . }}{{ .Values.helmController.job.image.repository }}:{{ .Values.helmController.job.image.tag }} +{{- end }} +{{- if not .Values.helmLocker.enabled }} + - --disable-embedded-helm-locker +{{- end }} +{{- if .Values.additionalArgs }} +{{- toYaml .Values.additionalArgs | nindent 10 }} +{{- end }} + env: + - name: NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + ## Note: The below two values only exist to force Helm to upgrade the deployment on + ## a change to the contents of the ConfigMap during an upgrade. Neither serve + ## any practical purpose and can be removed and replaced with a configmap reloader + ## in a future change if dynamic updates are required. + - name: HARDENING_OPTIONS_SHA_256_HASH + value: {{ .Values.hardenedNamespaces.configuration | toYaml | sha256sum }} + - name: VALUES_OVERRIDE_SHA_256_HASH + value: {{ .Values.valuesOverride | toYaml | sha256sum }} +{{- if .Values.resources }} + resources: {{ toYaml .Values.resources | nindent 12 }} +{{- end }} +{{- if .Values.containerSecurityContext }} + securityContext: {{ toYaml .Values.containerSecurityContext | nindent 12 }} +{{- end }} + volumeMounts: + - name: config + mountPath: "/etc/helmprojectoperator/config" + serviceAccountName: {{ template "helm-project-operator.name" . }} +{{- if .Values.securityContext }} + securityContext: {{ toYaml .Values.securityContext | nindent 8 }} +{{- end }} + nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} +{{- if .Values.nodeSelector }} +{{- toYaml .Values.nodeSelector | nindent 8 }} +{{- end }} + tolerations: {{ include "linux-node-tolerations" . | nindent 8 }} +{{- if .Values.tolerations }} +{{- toYaml .Values.tolerations | nindent 8 }} +{{- end }} + volumes: + - name: config + configMap: + name: {{ template "helm-project-operator.name" . }}-config diff --git a/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/templates/psp.yaml b/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/templates/psp.yaml new file mode 100644 index 000000000..73dcc4560 --- /dev/null +++ b/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/templates/psp.yaml @@ -0,0 +1,68 @@ +{{- if .Values.global.cattle.psp.enabled }} +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: {{ template "helm-project-operator.name" . }}-psp + namespace: {{ template "helm-project-operator.namespace" . }} + labels: {{ include "helm-project-operator.labels" . | nindent 4 }} + app: {{ template "helm-project-operator.name" . }} +{{- if .Values.global.rbac.pspAnnotations }} + annotations: {{ toYaml .Values.global.rbac.pspAnnotations | nindent 4 }} +{{- end }} +spec: + privileged: false + hostNetwork: false + hostIPC: false + hostPID: false + runAsUser: + # Permits the container to run with root privileges as well. + rule: 'RunAsAny' + seLinux: + # This policy assumes the nodes are using AppArmor rather than SELinux. + rule: 'RunAsAny' + supplementalGroups: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 0 + max: 65535 + fsGroup: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 0 + max: 65535 + readOnlyRootFilesystem: false +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ template "helm-project-operator.name" . }}-psp + labels: {{ include "helm-project-operator.labels" . | nindent 4 }} + app: {{ template "helm-project-operator.name" . }} +rules: +{{- if semverCompare "> 1.15.0-0" .Capabilities.KubeVersion.GitVersion }} +- apiGroups: ['policy'] +{{- else }} +- apiGroups: ['extensions'] +{{- end }} + resources: ['podsecuritypolicies'] + verbs: ['use'] + resourceNames: + - {{ template "helm-project-operator.name" . }}-psp +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ template "helm-project-operator.name" . }}-psp + labels: {{ include "helm-project-operator.labels" . | nindent 4 }} + app: {{ template "helm-project-operator.name" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "helm-project-operator.name" . }}-psp +subjects: + - kind: ServiceAccount + name: {{ template "helm-project-operator.name" . }} + namespace: {{ template "helm-project-operator.namespace" . }} +{{- end }} diff --git a/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/templates/rbac.yaml b/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/templates/rbac.yaml new file mode 100644 index 000000000..b1c409202 --- /dev/null +++ b/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/templates/rbac.yaml @@ -0,0 +1,32 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "helm-project-operator.name" . }} + labels: {{ include "helm-project-operator.labels" . | nindent 4 }} + app: {{ template "helm-project-operator.name" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: "cluster-admin" # see note below +subjects: +- kind: ServiceAccount + name: {{ template "helm-project-operator.name" . }} + namespace: {{ template "helm-project-operator.namespace" . }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "helm-project-operator.name" . }} + namespace: {{ template "helm-project-operator.namespace" . }} + labels: {{ include "helm-project-operator.labels" . | nindent 4 }} + app: {{ template "helm-project-operator.name" . }} +{{- if .Values.global.imagePullSecrets }} +imagePullSecrets: {{ toYaml .Values.global.imagePullSecrets | nindent 2 }} +{{- end }} +# --- +# NOTE: +# As of now, due to the fact that the k3s-io/helm-controller can only deploy jobs that are cluster-bound to the cluster-admin +# ClusterRole, the only way for this operator to be able to perform that binding is if it is also bound to the cluster-admin ClusterRole. +# +# As a result, this ClusterRoleBinding will be left as a work-in-progress until changes are made in k3s-io/helm-controller to allow us to grant +# only scoped down permissions to the Job that is deployed. diff --git a/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/templates/system-namespaces-configmap.yaml b/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/templates/system-namespaces-configmap.yaml new file mode 100644 index 000000000..f4c85254e --- /dev/null +++ b/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/templates/system-namespaces-configmap.yaml @@ -0,0 +1,62 @@ +{{- if .Values.systemNamespacesConfigMap.create }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "helm-project-operator.name" . }}-system-namespaces + namespace: {{ template "helm-project-operator.namespace" . }} + labels: {{ include "helm-project-operator.labels" . | nindent 4 }} +data: + system-namespaces.json: |- + { +{{- if .Values.projectReleaseNamespaces.enabled }} +{{- if .Values.projectReleaseNamespaces.labelValue }} + "projectReleaseLabelValue": {{ .Values.projectReleaseNamespaces.labelValue | quote }}, +{{- else if .Values.global.cattle.systemProjectId }} + "projectReleaseLabelValue": {{ .Values.global.cattle.systemProjectId | quote }}, +{{- else }} + "projectReleaseLabelValue": "", +{{- end }} +{{- else }} + "projectReleaseLabelValue": "", +{{- end }} +{{- if not .Values.projectReleaseNamespaces.enabled }} + "systemProjectLabelValues": {{ append .Values.otherSystemProjectLabelValues .Values.global.cattle.systemProjectId | toJson }} +{{- else if and (ne (len .Values.global.cattle.systemProjectId) 0) (ne (len .Values.projectReleaseNamespaces.labelValue) 0) (ne .Values.projectReleaseNamespaces.labelValue .Values.global.cattle.systemProjectId) }} + "systemProjectLabelValues": {{ append .Values.otherSystemProjectLabelValues .Values.global.cattle.systemProjectId | toJson }} +{{- else if len .Values.otherSystemProjectLabelValues }} + "systemProjectLabelValues": {{ .Values.otherSystemProjectLabelValues | toJson }} +{{- else }} + "systemProjectLabelValues": [] +{{- end }} + } +--- +{{- if (and .Values.systemNamespacesConfigMap.rbac.enabled .Values.systemNamespacesConfigMap.rbac.subjects) }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ template "helm-project-operator.name" . }}-system-namespaces + namespace: {{ template "helm-project-operator.namespace" . }} + labels: {{ include "helm-project-operator.labels" . | nindent 4 }} +rules: +- apiGroups: + - "" + resources: + - configmaps + resourceNames: + - "{{ template "helm-project-operator.name" . }}-system-namespaces" + verbs: + - 'get' +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ template "helm-project-operator.name" . }}-system-namespaces + namespace: {{ template "helm-project-operator.namespace" . }} + labels: {{ include "helm-project-operator.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "helm-project-operator.name" . }}-system-namespaces +subjects: {{ .Values.systemNamespacesConfigMap.rbac.subjects | toYaml | nindent 2 }} +{{- end }} +{{- end }} diff --git a/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/templates/validate-psp-install.yaml b/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/templates/validate-psp-install.yaml new file mode 100644 index 000000000..a30c59d3b --- /dev/null +++ b/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/templates/validate-psp-install.yaml @@ -0,0 +1,7 @@ +#{{- if gt (len (lookup "rbac.authorization.k8s.io/v1" "ClusterRole" "" "")) 0 -}} +#{{- if .Values.global.cattle.psp.enabled }} +#{{- if not (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") }} +#{{- fail "The target cluster does not have the PodSecurityPolicy API resource. Please disable PSPs in this chart before proceeding." -}} +#{{- end }} +#{{- end }} +#{{- end }} diff --git a/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/values.yaml b/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/values.yaml new file mode 100644 index 000000000..63fae45af --- /dev/null +++ b/charts/prometheus-federator/0.3.0+up0.3.3/charts/helmProjectOperator/values.yaml @@ -0,0 +1,228 @@ +# Default values for helm-project-operator. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +# Helm Project Operator Configuration + +global: + cattle: + clusterId: "" + psp: + enabled: false + projectLabel: field.cattle.io/projectId + systemDefaultRegistry: "" + systemProjectId: "" + url: "" + rbac: + ## Create RBAC resources for ServiceAccounts and users + ## + create: true + + userRoles: + ## Create default user ClusterRoles to allow users to interact with ProjectHelmCharts + create: true + ## Aggregate default user ClusterRoles into default k8s ClusterRoles + aggregateToDefaultRoles: true + + pspAnnotations: {} + ## Specify pod annotations + ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#apparmor + ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp + ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#sysctl + ## + # seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*' + # seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default' + # apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' + + ## Reference to one or more secrets to be used when pulling images + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + imagePullSecrets: [] + # - name: "image-pull-secret" + +helmApiVersion: dummy.cattle.io/v1alpha1 + +## valuesOverride overrides values that are set on each ProjectHelmChart deployment on an operator-level +## User-provided values will be overwritten based on the values provided here +valuesOverride: {} + +## projectReleaseNamespaces are auto-generated namespaces that are created to host Helm Releases +## managed by this operator on behalf of a ProjectHelmChart +projectReleaseNamespaces: + ## Enabled determines whether Project Release Namespaces should be created. If false, the underlying + ## Helm release will be deployed in the Project Registration Namespace + enabled: true + ## labelValue is the value of the Project that the projectReleaseNamespace should be created within + ## If empty, this will be set to the value of global.cattle.systemProjectId + ## If global.cattle.systemProjectId is also empty, project release namespaces will be disabled + labelValue: "" + +## otherSystemProjectLabelValues are project labels that identify namespaces as those that should be treated as system projects +## i.e. they will be entirely ignored by the operator +## By default, the global.cattle.systemProjectId will be in this list +otherSystemProjectLabelValues: [] + +## releaseRoleBindings configures RoleBindings automatically created by the Helm Project Operator +## in Project Release Namespaces where underlying Helm charts are deployed +releaseRoleBindings: + ## aggregate enables creating these RoleBindings off aggregating RoleBindings in the + ## Project Registration Namespace or ClusterRoleBindings that bind users to the ClusterRoles + ## specified under clusterRoleRefs + aggregate: true + + ## clusterRoleRefs are the ClusterRoles whose RoleBinding or ClusterRoleBindings should determine + ## the RoleBindings created in the Project Release Namespace + ## + ## By default, these are set to create RoleBindings based on the RoleBindings / ClusterRoleBindings + ## attached to the default K8s user-facing ClusterRoles of admin, edit, and view. + ## ref: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles + ## + clusterRoleRefs: + admin: admin + edit: edit + view: view + +hardenedNamespaces: + # Whether to automatically manage the configuration of the default ServiceAccount and + # auto-create a NetworkPolicy for each namespace created by this operator + enabled: true + + configuration: + # Values to be applied to each default ServiceAccount created in a managed namespace + serviceAccountSpec: + secrets: [] + imagePullSecrets: [] + automountServiceAccountToken: false + # Values to be applied to each default generated NetworkPolicy created in a managed namespace + networkPolicySpec: + podSelector: {} + egress: [] + ingress: [] + policyTypes: ["Ingress", "Egress"] + +## systemNamespacesConfigMap is a ConfigMap created to allow users to see valid entries +## for registering a ProjectHelmChart for a given Project on the Rancher Dashboard UI. +## It does not need to be enabled for a non-Rancher use case. +systemNamespacesConfigMap: + ## Create indicates whether the system namespaces configmap should be created + ## This is a required value for integration with Rancher Dashboard + create: true + + ## RBAC provides options around the RBAC created to allow users to be able to view + ## the systemNamespacesConfigMap; if not specified, only users with the ability to + ## view ConfigMaps in the namespace where this chart is deployed will be able to + ## properly view the system namespaces on the Rancher Dashboard UI + rbac: + ## enabled indicates that we should deploy a RoleBinding and Role to view this ConfigMap + enabled: true + ## subjects are the subjects that should be bound to this default RoleBinding + ## By default, we allow anyone who is authenticated to the system to be able to view + ## this ConfigMap in the deployment namespace + subjects: + - kind: Group + name: system:authenticated + +nameOverride: "" + +namespaceOverride: "" + +replicas: 1 + +image: + repository: rancher/helm-project-operator + tag: v0.2.1 + pullPolicy: IfNotPresent + +helmController: + # Note: should be disabled for RKE2 clusters since they already run Helm Controller to manage internal Kubernetes components + enabled: true + + job: + image: + repository: rancher/klipper-helm + tag: v0.7.0-build20220315 + +helmLocker: + enabled: true + +# Additional arguments to be passed into the Helm Project Operator image +additionalArgs: [] + +## Define which Nodes the Pods are scheduled on. +## ref: https://kubernetes.io/docs/user-guide/node-selection/ +## +nodeSelector: {} + +## Tolerations for use with node taints +## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ +## +tolerations: [] +# - key: "key" +# operator: "Equal" +# value: "value" +# effect: "NoSchedule" + +resources: {} + # limits: + # memory: 500Mi + # cpu: 1000m + # requests: + # memory: 100Mi + # cpu: 100m + +containerSecurityContext: {} + # allowPrivilegeEscalation: false + # capabilities: + # drop: + # - ALL + # privileged: false + # readOnlyRootFilesystem: true + +securityContext: {} + # runAsGroup: 1000 + # runAsUser: 1000 + # supplementalGroups: + # - 1000 + +debug: false +debugLevel: 0 + +cleanup: + image: + repository: rancher/shell + tag: v0.1.19 + pullPolicy: IfNotPresent + + ## Define which Nodes the Pods are scheduled on. + ## ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## + nodeSelector: {} + + ## Tolerations for use with node taints + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + # - key: "key" + # operator: "Equal" + # value: "value" + # effect: "NoSchedule" + + containerSecurityContext: {} + # allowPrivilegeEscalation: false + # capabilities: + # drop: + # - ALL + # privileged: false + # readOnlyRootFilesystem: true + + securityContext: + runAsNonRoot: false + runAsUser: 0 + + resources: {} + # limits: + # memory: 500Mi + # cpu: 1000m + # requests: + # memory: 100Mi + # cpu: 100m diff --git a/charts/prometheus-federator/0.3.0+up0.3.3/questions.yaml b/charts/prometheus-federator/0.3.0+up0.3.3/questions.yaml new file mode 100644 index 000000000..981e1c067 --- /dev/null +++ b/charts/prometheus-federator/0.3.0+up0.3.3/questions.yaml @@ -0,0 +1,37 @@ +questions: +- variable: helmProjectOperator.helmController.enabled + label: Enable Embedded Helm Controller + description: 'Note: If you are running Prometheus Federator in an RKE2 / K3s cluster before v1.23.14 / v1.24.8 / v1.25.4, this should be disabled.' + type: boolean + group: Helm Controller +- variable: helmProjectOperator.helmLocker.enabled + label: Enable Embedded Helm Locker + type: boolean + group: Helm Locker +- variable: helmProjectOperator.projectReleaseNamespaces.labelValue + label: Project Release Namespace Project ID + description: By default, the System Project is selected. This can be overriden to a different Project (e.g. p-xxxxx) + type: string + required: false + group: Namespaces +- variable: helmProjectOperator.releaseRoleBindings.clusterRoleRefs.admin + label: Admin ClusterRole + description: By default, admin selects Project Owners. This can be overridden to a different ClusterRole (e.g. rt-xxxxx) + type: string + default: admin + required: false + group: RBAC +- variable: helmProjectOperator.releaseRoleBindings.clusterRoleRefs.edit + label: Edit ClusterRole + description: By default, edit selects Project Members. This can be overridden to a different ClusterRole (e.g. rt-xxxxx) + type: string + default: edit + required: false + group: RBAC +- variable: helmProjectOperator.releaseRoleBindings.clusterRoleRefs.view + label: View ClusterRole + description: By default, view selects Read-Only users. This can be overridden to a different ClusterRole (e.g. rt-xxxxx) + type: string + default: view + required: false + group: RBAC \ No newline at end of file diff --git a/charts/prometheus-federator/0.3.0+up0.3.3/templates/NOTES.txt b/charts/prometheus-federator/0.3.0+up0.3.3/templates/NOTES.txt new file mode 100644 index 000000000..f551f3661 --- /dev/null +++ b/charts/prometheus-federator/0.3.0+up0.3.3/templates/NOTES.txt @@ -0,0 +1,3 @@ +{{ $.Chart.Name }} has been installed. Check its status by running: + kubectl --namespace {{ template "prometheus-federator.namespace" . }} get pods -l "release={{ $.Release.Name }}" + diff --git a/charts/prometheus-federator/0.3.0+up0.3.3/templates/_helpers.tpl b/charts/prometheus-federator/0.3.0+up0.3.3/templates/_helpers.tpl new file mode 100644 index 000000000..15ea4e5c8 --- /dev/null +++ b/charts/prometheus-federator/0.3.0+up0.3.3/templates/_helpers.tpl @@ -0,0 +1,66 @@ +# Rancher +{{- define "system_default_registry" -}} +{{- if .Values.global.cattle.systemDefaultRegistry -}} +{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}} +{{- end -}} +{{- end -}} + +# Windows Support + +{{/* +Windows cluster will add default taint for linux nodes, +add below linux tolerations to workloads could be scheduled to those linux nodes +*/}} + +{{- define "linux-node-tolerations" -}} +- key: "cattle.io/os" + value: "linux" + effect: "NoSchedule" + operator: "Equal" +{{- end -}} + +{{- define "linux-node-selector" -}} +{{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}} +beta.kubernetes.io/os: linux +{{- else -}} +kubernetes.io/os: linux +{{- end -}} +{{- end -}} + +# Helm Project Operator + +{{/* vim: set filetype=mustache: */}} +{{/* Expand the name of the chart. This is suffixed with -alertmanager, which means subtract 13 from longest 63 available */}} +{{- define "prometheus-federator.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 50 | trimSuffix "-" -}} +{{- end }} + +{{/* +Allow the release namespace to be overridden for multi-namespace deployments in combined charts +*/}} +{{- define "prometheus-federator.namespace" -}} + {{- if .Values.namespaceOverride -}} + {{- .Values.namespaceOverride -}} + {{- else -}} + {{- .Release.Namespace -}} + {{- end -}} +{{- end -}} + +{{/* Create chart name and version as used by the chart label. */}} +{{- define "prometheus-federator.chartref" -}} +{{- replace "+" "_" .Chart.Version | printf "%s-%s" .Chart.Name -}} +{{- end }} + +{{/* Generate basic labels */}} +{{- define "prometheus-federator.labels" }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +app.kubernetes.io/instance: {{ .Release.Name }} +app.kubernetes.io/version: "{{ replace "+" "_" .Chart.Version }}" +app.kubernetes.io/part-of: {{ template "prometheus-federator.name" . }} +chart: {{ template "prometheus-federator.chartref" . }} +release: {{ $.Release.Name | quote }} +heritage: {{ $.Release.Service | quote }} +{{- if .Values.commonLabels}} +{{ toYaml .Values.commonLabels }} +{{- end }} +{{- end }} diff --git a/charts/prometheus-federator/0.3.0+up0.3.3/values.yaml b/charts/prometheus-federator/0.3.0+up0.3.3/values.yaml new file mode 100644 index 000000000..699e6c9ba --- /dev/null +++ b/charts/prometheus-federator/0.3.0+up0.3.3/values.yaml @@ -0,0 +1,94 @@ +# Default values for helm-project-operator. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +# Prometheus Federator Configuration + +global: + cattle: + psp: + enabled: true + systemDefaultRegistry: "" + projectLabel: field.cattle.io/projectId + clusterId: "" + systemProjectId: "" + url: "" + rbac: + pspEnabled: true + pspAnnotations: {} + ## Specify pod annotations + ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#apparmor + ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp + ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#sysctl + ## + # seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*' + # seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default' + # apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' + + ## Reference to one or more secrets to be used when pulling images + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + imagePullSecrets: [] + # - name: "image-pull-secret" + +helmProjectOperator: + enabled: true + + # ensures that all resources created by subchart show up as prometheus-federator + helmApiVersion: monitoring.cattle.io/v1alpha1 + + nameOverride: prometheus-federator + + helmController: + # Note: should be disabled for RKE2 clusters since they already run Helm Controller to manage internal Kubernetes components + enabled: true + + helmLocker: + enabled: true + + ## valuesOverride overrides values that are set on each Project Prometheus Stack Helm Chart deployment on an operator level + ## all values provided here will override any user-provided values automatically + valuesOverride: + + federate: + # Change this to point at all Prometheuses you want all your Project Prometheus Stacks to federate from + # By default, this matches the default deployment of Rancher Monitoring + targets: + - rancher-monitoring-prometheus.cattle-monitoring-system.svc:9090 + + image: + repository: rancher/prometheus-federator + tag: v0.3.2 + pullPolicy: IfNotPresent + + # Additional arguments to be passed into the Prometheus Federator image + additionalArgs: [] + + ## Define which Nodes the Pods are scheduled on. + ## ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## + nodeSelector: {} + + ## Tolerations for use with node taints + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + # - key: "key" + # operator: "Equal" + # value: "value" + # effect: "NoSchedule" + + resources: {} + # limits: + # memory: 500Mi + # cpu: 1000m + # requests: + # memory: 100Mi + # cpu: 100m + + securityContext: {} + # allowPrivilegeEscalation: false + # readOnlyRootFilesystem: true + + debug: false + debugLevel: 0 \ No newline at end of file diff --git a/charts/rancher-aks-operator-crd/102.3.2+up1.1.3/Chart.yaml b/charts/rancher-aks-operator-crd/102.3.2+up1.1.3/Chart.yaml new file mode 100644 index 000000000..814f37329 --- /dev/null +++ b/charts/rancher-aks-operator-crd/102.3.2+up1.1.3/Chart.yaml @@ -0,0 +1,12 @@ +annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/namespace: cattle-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/release-name: rancher-aks-operator-crd +apiVersion: v2 +appVersion: 1.1.3 +description: AKS Operator CustomResourceDefinitions +name: rancher-aks-operator-crd +version: 102.3.2+up1.1.3 diff --git a/charts/rancher-aks-operator-crd/102.3.2+up1.1.3/templates/crds.yaml b/charts/rancher-aks-operator-crd/102.3.2+up1.1.3/templates/crds.yaml new file mode 100644 index 000000000..c4fcdfac0 --- /dev/null +++ b/charts/rancher-aks-operator-crd/102.3.2+up1.1.3/templates/crds.yaml @@ -0,0 +1,211 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + helm.sh/resource-policy: keep + name: aksclusterconfigs.aks.cattle.io +spec: + group: aks.cattle.io + names: + kind: AKSClusterConfig + plural: aksclusterconfigs + shortNames: + - akscc + singular: aksclusterconfig + preserveUnknownFields: false + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + spec: + properties: + authBaseUrl: + nullable: true + type: string + authorizedIpRanges: + items: + nullable: true + type: string + nullable: true + type: array + azureCredentialSecret: + nullable: true + type: string + baseUrl: + nullable: true + type: string + clusterName: + nullable: true + type: string + dnsPrefix: + nullable: true + type: string + dnsServiceIp: + nullable: true + type: string + dockerBridgeCidr: + nullable: true + type: string + httpApplicationRouting: + nullable: true + type: boolean + imported: + type: boolean + kubernetesVersion: + nullable: true + type: string + linuxAdminUsername: + nullable: true + type: string + loadBalancerSku: + nullable: true + type: string + logAnalyticsWorkspaceGroup: + nullable: true + type: string + logAnalyticsWorkspaceName: + nullable: true + type: string + managedIdentity: + nullable: true + type: boolean + monitoring: + nullable: true + type: boolean + networkPlugin: + nullable: true + type: string + networkPolicy: + nullable: true + type: string + nodePools: + items: + properties: + availabilityZones: + items: + nullable: true + type: string + nullable: true + type: array + count: + nullable: true + type: integer + enableAutoScaling: + nullable: true + type: boolean + maxCount: + nullable: true + type: integer + maxPods: + nullable: true + type: integer + maxSurge: + nullable: true + type: string + minCount: + nullable: true + type: integer + mode: + nullable: true + type: string + name: + nullable: true + type: string + nodeLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + nodeTaints: + items: + nullable: true + type: string + nullable: true + type: array + orchestratorVersion: + nullable: true + type: string + osDiskSizeGB: + nullable: true + type: integer + osDiskType: + nullable: true + type: string + osType: + nullable: true + type: string + vmSize: + nullable: true + type: string + vnetSubnetID: + nullable: true + type: string + type: object + nullable: true + type: array + nodeResourceGroup: + nullable: true + type: string + outboundType: + nullable: true + type: string + podCidr: + nullable: true + type: string + privateCluster: + nullable: true + type: boolean + privateDnsZone: + nullable: true + type: string + resourceGroup: + nullable: true + type: string + resourceLocation: + nullable: true + type: string + serviceCidr: + nullable: true + type: string + sshPublicKey: + nullable: true + type: string + subnet: + nullable: true + type: string + tags: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + userAssignedIdentity: + nullable: true + type: string + virtualNetwork: + nullable: true + type: string + virtualNetworkResourceGroup: + nullable: true + type: string + type: object + status: + properties: + failureMessage: + nullable: true + type: string + phase: + nullable: true + type: string + rbacEnabled: + nullable: true + type: boolean + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/charts/rancher-aks-operator/102.3.2+up1.1.3/Chart.yaml b/charts/rancher-aks-operator/102.3.2+up1.1.3/Chart.yaml new file mode 100644 index 000000000..a78c5c634 --- /dev/null +++ b/charts/rancher-aks-operator/102.3.2+up1.1.3/Chart.yaml @@ -0,0 +1,20 @@ +annotations: + catalog.cattle.io/auto-install: rancher-aks-operator-crd=match + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/kube-version: '>= 1.20.0-0 < 1.28.0-0' + catalog.cattle.io/namespace: cattle-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/provides-gvr: aksclusterconfigs.aks.cattle.io/v1 + catalog.cattle.io/rancher-version: '>= 2.7.0-0 < 2.8.0-0' + catalog.cattle.io/release-name: rancher-aks-operator + catalog.cattle.io/scope: management +apiVersion: v2 +appVersion: 1.1.3 +description: A Helm chart for provisioning AKS clusters +home: https://github.com/rancher/aks-operator +name: rancher-aks-operator +sources: +- https://github.com/rancher/aks-operator +version: 102.3.2+up1.1.3 diff --git a/charts/rancher-aks-operator/102.3.2+up1.1.3/templates/NOTES.txt b/charts/rancher-aks-operator/102.3.2+up1.1.3/templates/NOTES.txt new file mode 100644 index 000000000..5ba05b482 --- /dev/null +++ b/charts/rancher-aks-operator/102.3.2+up1.1.3/templates/NOTES.txt @@ -0,0 +1,4 @@ +You have deployed the Rancher AKS operator +Version: {{ .Chart.AppVersion }} +Description: This operator provisions AKS clusters +from AKSClusterConfig CRs. diff --git a/charts/rancher-aks-operator/102.3.2+up1.1.3/templates/_helpers.tpl b/charts/rancher-aks-operator/102.3.2+up1.1.3/templates/_helpers.tpl new file mode 100644 index 000000000..de3b332f6 --- /dev/null +++ b/charts/rancher-aks-operator/102.3.2+up1.1.3/templates/_helpers.tpl @@ -0,0 +1,25 @@ +{{/* vim: set filetype=mustache: */}} + +{{- define "system_default_registry" -}} +{{- if .Values.global.cattle.systemDefaultRegistry -}} +{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}} +{{- else -}} +{{- "" -}} +{{- end -}} +{{- end -}} + +{{/* +Windows cluster will add default taint for linux nodes, +add below linux tolerations to workloads could be scheduled to those linux nodes +*/}} +{{- define "linux-node-tolerations" -}} +- key: "cattle.io/os" + value: "linux" + effect: "NoSchedule" + operator: "Equal" +{{- end -}} + +{{- define "linux-node-selector" -}} +kubernetes.io/os: linux +{{- end -}} + diff --git a/charts/rancher-aks-operator/102.3.2+up1.1.3/templates/clusterrole.yaml b/charts/rancher-aks-operator/102.3.2+up1.1.3/templates/clusterrole.yaml new file mode 100644 index 000000000..5e2ce9756 --- /dev/null +++ b/charts/rancher-aks-operator/102.3.2+up1.1.3/templates/clusterrole.yaml @@ -0,0 +1,15 @@ +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: aks-operator + namespace: cattle-system +rules: + - apiGroups: [''] + resources: ['secrets'] + verbs: ['get', 'list', 'create', 'watch', 'update'] + - apiGroups: ['aks.cattle.io'] + resources: ['aksclusterconfigs'] + verbs: ['get', 'list', 'update', 'watch'] + - apiGroups: ['aks.cattle.io'] + resources: ['aksclusterconfigs/status'] + verbs: ['update'] diff --git a/charts/rancher-aks-operator/102.3.2+up1.1.3/templates/clusterrolebinding.yaml b/charts/rancher-aks-operator/102.3.2+up1.1.3/templates/clusterrolebinding.yaml new file mode 100644 index 000000000..7aa7e785a --- /dev/null +++ b/charts/rancher-aks-operator/102.3.2+up1.1.3/templates/clusterrolebinding.yaml @@ -0,0 +1,13 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: aks-operator + namespace: cattle-system +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: aks-operator +subjects: +- kind: ServiceAccount + name: aks-operator + namespace: cattle-system diff --git a/charts/rancher-aks-operator/102.3.2+up1.1.3/templates/deployment.yaml b/charts/rancher-aks-operator/102.3.2+up1.1.3/templates/deployment.yaml new file mode 100644 index 000000000..1d85eb18c --- /dev/null +++ b/charts/rancher-aks-operator/102.3.2+up1.1.3/templates/deployment.yaml @@ -0,0 +1,61 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: aks-config-operator + namespace: cattle-system +spec: + replicas: 1 + selector: + matchLabels: + ke.cattle.io/operator: aks + template: + metadata: + labels: + ke.cattle.io/operator: aks + spec: + nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} +{{- if .Values.nodeSelector }} +{{ toYaml .Values.nodeSelector | indent 8 }} +{{- end }} + tolerations: {{ include "linux-node-tolerations" . | nindent 8 }} +{{- if .Values.tolerations }} +{{ toYaml .Values.tolerations | indent 8 }} +{{- end }} + serviceAccountName: aks-operator + {{- if .Values.priorityClassName }} + priorityClassName: "{{.Values.priorityClassName}}" + {{- end }} + securityContext: + fsGroup: 1007 + runAsUser: 1007 + containers: + - name: aks-operator + image: {{ template "system_default_registry" . }}{{ .Values.aksOperator.image.repository }}:{{ .Values.aksOperator.image.tag }} + imagePullPolicy: IfNotPresent + env: + - name: HTTP_PROXY + value: {{ .Values.httpProxy }} + - name: HTTPS_PROXY + value: {{ .Values.httpsProxy }} + - name: NO_PROXY + value: {{ .Values.noProxy }} +{{- if .Values.additionalTrustedCAs }} + # aks-operator mounts the additional CAs in two places: + volumeMounts: + # This directory is owned by the aks-operator user so c_rehash works here. + - mountPath: /etc/rancher/ssl/ca-additional.pem + name: tls-ca-additional-volume + subPath: ca-additional.pem + readOnly: true + # This directory is root-owned so c_rehash doesn't work here, + # but the cert is here in case update-ca-certificates is called in the future or by the OS. + - mountPath: /etc/pki/trust/anchors/ca-additional.pem + name: tls-ca-additional-volume + subPath: ca-additional.pem + readOnly: true + volumes: + - name: tls-ca-additional-volume + secret: + defaultMode: 0400 + secretName: tls-ca-additional + {{- end }} diff --git a/charts/rancher-aks-operator/102.3.2+up1.1.3/templates/serviceaccount.yaml b/charts/rancher-aks-operator/102.3.2+up1.1.3/templates/serviceaccount.yaml new file mode 100644 index 000000000..9c40a152f --- /dev/null +++ b/charts/rancher-aks-operator/102.3.2+up1.1.3/templates/serviceaccount.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + namespace: cattle-system + name: aks-operator diff --git a/charts/rancher-aks-operator/102.3.2+up1.1.3/values.yaml b/charts/rancher-aks-operator/102.3.2+up1.1.3/values.yaml new file mode 100644 index 000000000..c3de655f3 --- /dev/null +++ b/charts/rancher-aks-operator/102.3.2+up1.1.3/values.yaml @@ -0,0 +1,23 @@ +global: + cattle: + systemDefaultRegistry: "" + +aksOperator: + image: + repository: rancher/aks-operator + tag: v1.1.3 + +httpProxy: "" +httpsProxy: "" +noProxy: "" +additionalTrustedCAs: false + +## Node labels for pod assignment +## Ref: https://kubernetes.io/docs/user-guide/node-selection/ +## +nodeSelector: {} +## List of node taints to tolerate (requires Kubernetes >= 1.6) +tolerations: [] + +## PriorityClassName assigned to deployment. +priorityClassName: "" diff --git a/index.yaml b/index.yaml index 243786ca2..4d4a06161 100755 --- a/index.yaml +++ b/index.yaml @@ -110,6 +110,61 @@ entries: urls: - assets/epinio/epinio-103.0.0+up1.8.1.tgz version: 103.0.0+up1.8.1 + - annotations: + artifacthub.io/license: Apache-2.0 + artifacthub.io/prerelease: "false" + catalog.cattle.io/auto-install: epinio-crd=match + catalog.cattle.io/certified: rancher + catalog.cattle.io/display-name: Epinio + catalog.cattle.io/experimental: "true" + catalog.cattle.io/kube-version: '>= 1.23.0-0 < 1.28.0-0' + catalog.cattle.io/namespace: cattle-epinio-system + catalog.cattle.io/permits-os: linux + catalog.cattle.io/rancher-version: '>= 2.7.0-0 < 2.8.0-0' + catalog.cattle.io/release-name: epinio + catalog.cattle.io/type: app + catalog.cattle.io/upstream-version: 1.9.0 + apiVersion: v2 + appVersion: v1.9.0 + created: "2023-09-21T15:01:47.049754-07:00" + dependencies: + - condition: global.dex.enabled + name: dex + repository: file://./charts/dex + tags: + - dex + - condition: kubed.enabled, global.kubed.enabled + name: kubed + repository: file://./charts/kubed + tags: + - kubed + - condition: minio.enabled, global.minio.enabled + name: minio + repository: file://./charts/minio + tags: + - minio + - condition: s3gw.enabled, global.s3gw.enabled + name: s3gw + repository: file://./charts/s3gw + tags: + - s3gw + description: Epinio deploys Kubernetes applications directly from source code + in one step. + digest: 553ab5adf47549107e205a2dddf5d362189f525757ef8a69a0bb4d365fe5afa5 + home: https://github.com/epinio/epinio + icon: https://charts.rancher.io/assets/logos/epinio.svg + keywords: + - epinio + - paas + maintainers: + - email: team@epinio.io + name: SUSE + name: epinio + sources: + - https://github.com/epinio/epinio + urls: + - assets/epinio/epinio-102.0.4+up1.9.0.tgz + version: 102.0.4+up1.9.0 - annotations: artifacthub.io/license: Apache-2.0 catalog.cattle.io/auto-install: epinio-crd=match @@ -349,6 +404,20 @@ entries: urls: - assets/epinio-crd/epinio-crd-103.0.0+up1.8.1.tgz version: 103.0.0+up1.8.1 + - annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/namespace: cattle-epinio-system + catalog.cattle.io/release-name: epinio-crd + apiVersion: v2 + created: "2023-09-21T15:02:35.693033-07:00" + description: Installs the CRDs for Epinio. + digest: 6704572ee09b773d99c97c441d25350c1193ef9ded8ecc9f652f430ddbab7321 + name: epinio-crd + type: application + urls: + - assets/epinio-crd/epinio-crd-102.0.4+up1.9.0.tgz + version: 102.0.4+up1.9.0 - annotations: catalog.cattle.io/certified: rancher catalog.cattle.io/hidden: "true" @@ -432,6 +501,32 @@ entries: urls: - assets/fleet/fleet-103.1.0+up0.9.0-rc.1.tgz version: 103.1.0+up0.9.0-rc.1 + - annotations: + catalog.cattle.io/auto-install: fleet-crd=match + catalog.cattle.io/certified: rancher + catalog.cattle.io/experimental: "true" + catalog.cattle.io/hidden: "true" + catalog.cattle.io/kube-version: '>= 1.16.0-0 < 1.27.0-0' + catalog.cattle.io/namespace: cattle-fleet-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/provides-gvr: clusters.fleet.cattle.io/v1alpha1 + catalog.cattle.io/rancher-version: '>= 2.7.0-0 < 2.8.0-0' + catalog.cattle.io/release-name: fleet + apiVersion: v2 + appVersion: 0.8.0 + created: "2023-09-21T15:04:34.335851-07:00" + dependencies: + - condition: gitops.enabled + name: gitjob + repository: file://./charts/gitjob + description: Fleet Manager - GitOps at Scale + digest: c124a9998d516d827034032a7e9c10dbf00a55e07205e26b6367f98d5f5d32e6 + icon: https://charts.rancher.io/assets/logos/fleet.svg + name: fleet + urls: + - assets/fleet/fleet-102.2.0+up0.8.0.tgz + version: 102.2.0+up0.8.0 - annotations: catalog.cattle.io/auto-install: fleet-crd=match catalog.cattle.io/certified: rancher @@ -1001,6 +1096,25 @@ entries: urls: - assets/fleet-agent/fleet-agent-103.1.0+up0.9.0-rc.1.tgz version: 103.1.0+up0.9.0-rc.1 + - annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/kube-version: '>= 1.16.0-0 < 1.27.0-0' + catalog.cattle.io/namespace: cattle-fleet-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/rancher-version: '>= 2.7.0-0 < 2.8.0-0' + catalog.cattle.io/release-name: fleet-agent + apiVersion: v2 + appVersion: 0.8.0 + created: "2023-09-21T15:05:06.083618-07:00" + description: Fleet Manager Agent - GitOps at Scale + digest: 2a22799f825ea69e567692ada7beeb885c976400e6bca238853abef7337f9eaa + icon: https://charts.rancher.io/assets/logos/fleet.svg + name: fleet-agent + urls: + - assets/fleet-agent/fleet-agent-102.2.0+up0.8.0.tgz + version: 102.2.0+up0.8.0 - annotations: catalog.cattle.io/certified: rancher catalog.cattle.io/hidden: "true" @@ -1431,6 +1545,23 @@ entries: urls: - assets/fleet-crd/fleet-crd-103.1.0+up0.9.0-rc.1.tgz version: 103.1.0+up0.9.0-rc.1 + - annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/namespace: cattle-fleet-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/release-name: fleet-crd + apiVersion: v2 + appVersion: 0.8.0 + created: "2023-09-21T15:05:26.518269-07:00" + description: Fleet Manager CustomResourceDefinitions + digest: 46b9c9e966e4c5659488ac7dc4ced4fd2ccce290d8b676e0c866f72a0846eda6 + icon: https://charts.rancher.io/assets/logos/fleet.svg + name: fleet-crd + urls: + - assets/fleet-crd/fleet-crd-102.2.0+up0.8.0.tgz + version: 102.2.0+up0.8.0 - annotations: catalog.cattle.io/certified: rancher catalog.cattle.io/hidden: "true" @@ -4848,6 +4979,30 @@ entries: urls: - assets/prometheus-federator/prometheus-federator-1.0.0+up0.1.1.tgz version: 1.0.0+up0.1.1 + - annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/display-name: Prometheus Federator + catalog.cattle.io/kube-version: '>= 1.16.0-0 < 1.25.0-0' + catalog.cattle.io/namespace: cattle-monitoring-system + catalog.cattle.io/os: linux,windows + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/provides-gvr: helm.cattle.io.projecthelmchart/v1alpha1 + catalog.cattle.io/rancher-version: '>= 2.6.5-0 < 2.7.0-0' + catalog.cattle.io/release-name: prometheus-federator + apiVersion: v2 + appVersion: 0.3.2 + created: "2023-09-21T15:07:20.483796-07:00" + dependencies: + - condition: helmProjectOperator.enabled + name: helmProjectOperator + repository: file://./charts/helmProjectOperator + description: Prometheus Federator + digest: 47127ade201ff9cdcb6db5f90c9396a9470addb6d37c1f0a657817bbf6433572 + icon: https://raw.githubusercontent.com/rancher/prometheus-federator/main/assets/logos/prometheus-federator.svg + name: prometheus-federator + urls: + - assets/prometheus-federator/prometheus-federator-0.3.0+up0.3.3.tgz + version: 0.3.0+up0.3.3 - annotations: catalog.cattle.io/certified: rancher catalog.cattle.io/display-name: Prometheus Federator @@ -4945,6 +5100,30 @@ entries: urls: - assets/rancher-aks-operator/rancher-aks-operator-103.0.0+up1.2.0-rc4.tgz version: 103.0.0+up1.2.0-rc4 + - annotations: + catalog.cattle.io/auto-install: rancher-aks-operator-crd=match + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/kube-version: '>= 1.20.0-0 < 1.28.0-0' + catalog.cattle.io/namespace: cattle-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/provides-gvr: aksclusterconfigs.aks.cattle.io/v1 + catalog.cattle.io/rancher-version: '>= 2.7.0-0 < 2.8.0-0' + catalog.cattle.io/release-name: rancher-aks-operator + catalog.cattle.io/scope: management + apiVersion: v2 + appVersion: 1.1.3 + created: "2023-09-21T15:10:02.292815-07:00" + description: A Helm chart for provisioning AKS clusters + digest: fa104d36d644550d79dae79d035b91a53511fc0892bf072ee967b8c7cc37409b + home: https://github.com/rancher/aks-operator + name: rancher-aks-operator + sources: + - https://github.com/rancher/aks-operator + urls: + - assets/rancher-aks-operator/rancher-aks-operator-102.3.2+up1.1.3.tgz + version: 102.3.2+up1.1.3 - annotations: catalog.cattle.io/auto-install: rancher-aks-operator-crd=match catalog.cattle.io/certified: rancher @@ -5247,6 +5426,22 @@ entries: urls: - assets/rancher-aks-operator-crd/rancher-aks-operator-crd-103.0.0+up1.2.0-rc4.tgz version: 103.0.0+up1.2.0-rc4 + - annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/namespace: cattle-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/release-name: rancher-aks-operator-crd + apiVersion: v2 + appVersion: 1.1.3 + created: "2023-09-21T15:10:29.02289-07:00" + description: AKS Operator CustomResourceDefinitions + digest: 5e51e405aa276e32e05ed4ddd591bb64a5696ce5a6402d32117ead23dc95a894 + name: rancher-aks-operator-crd + urls: + - assets/rancher-aks-operator-crd/rancher-aks-operator-crd-102.3.2+up1.1.3.tgz + version: 102.3.2+up1.1.3 - annotations: catalog.cattle.io/certified: rancher catalog.cattle.io/hidden: "true" diff --git a/release.yaml b/release.yaml index adebb2138..a957c992c 100644 --- a/release.yaml +++ b/release.yaml @@ -1,9 +1,11 @@ epinio: - 103.0.0+up1.8.1 - 103.0.1+up1.9.0 + - 102.0.4+up1.9.0 epinio-crd: - 103.0.0+up1.8.1 - 103.0.1+up1.9.0 + - 102.0.4+up1.9.0 rancher-monitoring: - 103.0.0+up40.1.2 rancher-monitoring-crd: @@ -11,20 +13,25 @@ rancher-monitoring-crd: fleet: - 102.1.1+up0.7.1 - 103.1.0+up0.9.0-rc.1 + - 102.2.0+up0.8.0 fleet-agent: - 102.1.1+up0.7.1 - 103.1.0+up0.9.0-rc.1 + - 102.2.0+up0.8.0 fleet-crd: - 102.1.1+up0.7.1 - 103.1.0+up0.9.0-rc.1 + - 102.2.0+up0.8.0 rancher-provisioning-capi: - 103.0.0+up0.0.1 rancher-webhook: - 103.0.0+up0.4.0-rc7 rancher-aks-operator: - 103.0.0+up1.2.0-rc4 + - 102.3.2+up1.1.3 rancher-aks-operator-crd: - 103.0.0+up1.2.0-rc4 + - 102.3.2+up1.1.3 rancher-gke-operator: - 103.0.1+up1.2.0-rc2 rancher-gke-operator-crd: @@ -84,3 +91,5 @@ rancher-windows-gmsa-crd: - 3.0.0 rancher-project-monitoring: - 0.3.0+up0.3.3 +prometheus-federator: + - 0.3.0+up0.3.3