From aca79bb7cc4e880d3fc6c33060abc71b3f5bf39f Mon Sep 17 00:00:00 2001 From: Steven Crespo Date: Tue, 3 Jan 2023 15:31:09 -0800 Subject: [PATCH] Make charts --- ...lugin-operator-crd-101.0.1+up0.1.1-rc1.tgz | Bin 0 -> 824 bytes ...ui-plugin-operator-101.0.1+up0.1.1-rc1.tgz | Bin 0 -> 3436 bytes .../101.0.1+up0.1.1-rc1/Chart.yaml | 10 ++ .../101.0.1+up0.1.1-rc1/README.md | 2 + .../101.0.1+up0.1.1-rc1/templates/crds.yaml | 61 +++++++++ .../101.0.1+up0.1.1-rc1/Chart.yaml | 19 +++ .../templates/_helpers.tpl | 89 +++++++++++++ .../templates/dashboardrole.yaml | 33 +++++ .../templates/deployment.yaml | 67 ++++++++++ .../templates/hardened.yaml | 123 ++++++++++++++++++ .../templates/service.yaml | 15 +++ .../templates/serviceaccount.yaml | 101 ++++++++++++++ .../101.0.1+up0.1.1-rc1/values.yaml | 67 ++++++++++ index.yaml | 37 ++++++ 14 files changed, 624 insertions(+) create mode 100644 assets/ui-plugin-operator-crd/ui-plugin-operator-crd-101.0.1+up0.1.1-rc1.tgz create mode 100644 assets/ui-plugin-operator/ui-plugin-operator-101.0.1+up0.1.1-rc1.tgz create mode 100644 charts/ui-plugin-operator-crd/101.0.1+up0.1.1-rc1/Chart.yaml create mode 100644 charts/ui-plugin-operator-crd/101.0.1+up0.1.1-rc1/README.md create mode 100644 charts/ui-plugin-operator-crd/101.0.1+up0.1.1-rc1/templates/crds.yaml create mode 100644 charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/Chart.yaml create mode 100644 charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/templates/_helpers.tpl create mode 100644 charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/templates/dashboardrole.yaml create mode 100644 charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/templates/deployment.yaml create mode 100644 charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/templates/hardened.yaml create mode 100644 charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/templates/service.yaml create mode 100644 charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/templates/serviceaccount.yaml create mode 100644 charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/values.yaml diff --git a/assets/ui-plugin-operator-crd/ui-plugin-operator-crd-101.0.1+up0.1.1-rc1.tgz b/assets/ui-plugin-operator-crd/ui-plugin-operator-crd-101.0.1+up0.1.1-rc1.tgz new file mode 100644 index 0000000000000000000000000000000000000000..18a3caefa905e8b5239c6df94d309426807a2f50 GIT binary patch literal 824 zcmV-81IPRyiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PI&yZ{s!)^;y4Suss%5sFl52=oUCzAcqz~7MuH+oLJmYBteec z21WmSp$|9ykYg{h*+l@oi=feP<_*a=B5OVMre0|~b)EvU3sV`?#iGQ(=_6KV@^T0v z#E03eeF`D=pJJY8lWdmH=UF~~FXj`G&F3PYfcOr%Poj>DVIp3fYrnWR0<_jKvUWBW z34laK<5sCeW<#lV7m@<&drhi$Ph-FHp2@T-meLIeMcc`XA4+oiJ~Zj_T0W-+sJ541TF~{w^tGFT^Ig7c!{$!bWgH|G5zF z_w@fU|L}3t|Bt}7aL{Y|o5?nBF@5+gHu76%$%D44fJGhIRksvf9VA`Ry|%iQK}C!T z8JqsGQBb$1VtOFwBzlsK=PJ0`7l(T9gS6cUpiBMb`lgN7n!Kq4nyn${PvZM-&-q(4ump9jU`R5&TGu2K1V7*zm4x7b(!mwYzt}AW#tH ztL<#DUWUGF|4+Ox5B~Z0tsGQFyb6w-|875BUj6YYtdmu{;3|u0EKDbKNkrXT+2d`5Dc zVQyr3R8em|NM&qo0PH+#bK5wQ`OII@#mts>XHA;&D=F5_Re7Dcx!h$kDkrmBTiH|! zB3ly9AixDc#X86T{R$6KBt_eb?Xfdk!iSgwfqtRU=m(gJMkT9elt-dONwkoAr*k58 zyd(vC_Ao6;lH~aC(Ed%5r2luce|-3Cba-%dG&(riPmZ1?qr(@6qi2vj5dIrmr8JSx zl6&LoGxs}bgma;Zrh=<90LX|YOw8hpXw5LDVvkf>M3gH{7)xPYU7}3pKNLh~^TFvE zN=>H}^AsfE*&OBIu$-!rk!8e5fhqj@8pak2{Nk|;PCBn97%fmLDtHPz|M3Hi;?Z%O zL<#%_M)AIV+!>r|@Tihxn1bt!R-CD&(pU^m6DkEpd37=PwnSM_t)gbsE_|ju7oXMO za4(N82mA30&%l2C@_PCuG9(JUyw+DGASL}<4RQWNZH) zqdkXLI3*R+;FjI)cSVYlVH`Y%_j9U%Dj@KWlb_#2Qy~kYHRdp-Zon(d7?B7IA}N_L zRGkf=l@GgK*DUK#4M zN>aT%63nRq4`Dv!8>Joh`$4660a4mNvbz}$ks8u_Q7@}y+oANsN>%h&>jpeT z8#wY%M}=hhS7o=M@I|L#tHi4WNC%+>g_u-mhu^>60<+W!Rsmb zaLfV81lNRe<>cr3s4>`#8PBLPei1P)l_B0!yNQfzM`a~vI&H+-_hM@CUHg6$(KFS+ z`OdPD{;>Jlu4rro;()|wPFikmO=qX`D~T&5<$4O?A5`=Q74~2`q?>En@MA~+S_^CT zjSp7MqT0pvn&L(=GC{W40^13z)$McD7Px!%Aw7IC{t+V?Lipzp!cXDXZ!A$1f;(c> zM#Q?Ij@mi0B3AP~%Rma3mq2;Os{BSaV@Jr1LzQ<$-*{wkORKyLPMXYyc}L1JK5sU4 zOvPT4Nw~ZmnDPbwRSAtfnXE%`sgFFGEFGX)!@QF?DAU@H{u-(F8IA_2afy^$Wamsp zJj{fcL%0!uA=|N%g$sE;d5E8+4|)cFm>CKxn`2(F`aBj2+aT99&c2My%cuq1F%`i%njo{C)-?gAO@O3+uIa$(6f>Pd z_*T60_)T}MS}BA-8qXu_i)N6FdS`bQT4Aw3c`Az1xE$eMM)Bw{N{p>1C7Do0HANL0 zFU1?I_$R7s+hyQPP?O%)UgfAet9s+0fhB%w$8_5srQI0+qmLSq=aVWMwmG5s;GpBt=!);gQQ1u2P`3&!5n0 zuax3q*?Mo$`gwD$%XAHo?dcx$aVeyRtE+G|Pkr^o1an`&`1bDbNL8f3^dH4%QkAuUh6+rGVa zv;D`CiDiNOe%C>6vHyq3=%8=^lcTNuf0WiXK%^|y%GSJU7Jm~{(=#2`zr7(UV@*K+ z1vuq7at((Dj4IIVg>EcrtFRXPx{E`+s)V)dZ{6vJw4yP9+7)-C+Pf=nTD0Fz z{d!tr#l^A1QEwuTqb0x^fi2+F)OO2g4umzq-Rn84*;@RA6s&{!-3IE=tJYra#%bz|Z%Jdc--YaM3_#f0 z@wO{oRf>BKnR~6t48HV}*qt0=*vB$%m6F%st?JBO`i$GBy8PAxGtOh@MN7Wp)y;x- zE2YpP6D)=Ir{mT;B4-^Wks+`)J-1~Ad%9(dt6e4{h$7oP)E6;aAp4;ukyUwiAQ#rc z)V&{259p~vZ%|7Ul0kI_TS8`ZfgF_@OEJN;^9rose?r~w1}KT1r?9u)Z&#zYUe7@y z$?0#5r4!A-kb$l5VYCj5`ew%64C+(6BHQ)^?MDB9PGpW8^LyR}ysiF!{GxyV`^Dk$ z*8hK$*3@=w4nWxoFU>TBpOSDWN#F`ntC(S8yysQW@ZVyxQDUMr(;`J4FfY-Dx#l*9 zb%}B=#Ce!PDU_~nwePxLRXLL+$MxY+jtn(Mr9I}u6l|xevJ5fDd>1A-6%r%cZ7Wn% z@FtMCIS|-DJ}}_E-!6f!cfOIY*GGD-^EP;uu=T2Sp|Cm3G?BV?qTb@deg*)8o~6-9 zN%#!myHC6D9k)8!R?+6{svWAD?&$K;j&Jz{-c9UyMb}o~zJseP1ENqu%@T3SMEX>mFC~ee}*P}F3f=L z#m4vI9Qi*(f5q-9{J2swcX>06xP?&5wi(fK9qy3IY~3FGT8r^Dw%`saV=qV5WNhKX z&J6X=F6>yaJ0Dk95ZYzBlksaW02TiiQ4l(Vv9}maP?OQ#Smf{gmao>+TdUf&Rqh(+i^?NRqevA6Ekmudb z*W=S}$N2TDRmbYcbT{2AhAHg)Tq%9lI%jum-trCQ)kSBV9dp8$_I*{B%zmFm*vi(e zgWPew=8SDl-3SWG-S-Ht733m?^~_(U(snqvJk8) zYG4uUD4QtU>8BKK^Ah@7i@U|4e70u8{JLGMX8u5p>}`DW@0xab$D>gYqr0u|C;%v* zNmR8lHa*zyaJ%6BvaD_PYd6O}|L7hcIAFgq{;O-4_xu#>miR9@9__E+|K8ume~-~_ zI(nX>?&ChT8mOb27Y<)5wHo>4+4XhzIuqaeOlt^u^LjO9DCgQq;C9PM_o=8HK3)24 zll|`<;yasxTkF5aNB#Qmi_y_`|360ijqd;a#)(TGPEA1|eild0QSs zI4oQ1upTQs{|3}~qmcdawfY_b`a=r!cM^_2B+J|2`x^ literal 0 HcmV?d00001 diff --git a/charts/ui-plugin-operator-crd/101.0.1+up0.1.1-rc1/Chart.yaml b/charts/ui-plugin-operator-crd/101.0.1+up0.1.1-rc1/Chart.yaml new file mode 100644 index 000000000..f759761f3 --- /dev/null +++ b/charts/ui-plugin-operator-crd/101.0.1+up0.1.1-rc1/Chart.yaml @@ -0,0 +1,10 @@ +annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/namespace: cattle-ui-plugin-system + catalog.cattle.io/release-name: ui-plugin-operator-crd +apiVersion: v1 +description: Installs the CRDs for ui-plugin-operator. +name: ui-plugin-operator-crd +type: application +version: 101.0.1+up0.1.1-rc1 diff --git a/charts/ui-plugin-operator-crd/101.0.1+up0.1.1-rc1/README.md b/charts/ui-plugin-operator-crd/101.0.1+up0.1.1-rc1/README.md new file mode 100644 index 000000000..a68add828 --- /dev/null +++ b/charts/ui-plugin-operator-crd/101.0.1+up0.1.1-rc1/README.md @@ -0,0 +1,2 @@ +# ui-plugin-operator-crd +A Rancher chart that installs the CRDs used by ui-plugin-operator. diff --git a/charts/ui-plugin-operator-crd/101.0.1+up0.1.1-rc1/templates/crds.yaml b/charts/ui-plugin-operator-crd/101.0.1+up0.1.1-rc1/templates/crds.yaml new file mode 100644 index 000000000..18b71d5b0 --- /dev/null +++ b/charts/ui-plugin-operator-crd/101.0.1+up0.1.1-rc1/templates/crds.yaml @@ -0,0 +1,61 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: uiplugins.catalog.cattle.io +spec: + group: catalog.cattle.io + names: + kind: UIPlugin + plural: uiplugins + singular: uiplugin + preserveUnknownFields: false + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.release.name + name: Plugin Name + type: string + - jsonPath: .status.version + name: Version + type: string + - jsonPath: .status.state + name: State + type: string + name: v1 + schema: + openAPIV3Schema: + properties: + spec: + properties: + plugin: + properties: + endpoint: + nullable: true + type: string + metadata: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + name: + nullable: true + type: string + noCache: + type: boolean + version: + nullable: true + type: string + type: object + type: object + status: + properties: + cacheState: + nullable: true + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/Chart.yaml b/charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/Chart.yaml new file mode 100644 index 000000000..98f778614 --- /dev/null +++ b/charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/Chart.yaml @@ -0,0 +1,19 @@ +annotations: + catalog.cattle.io/auto-install: ui-plugin-operator-crd=match + catalog.cattle.io/certified: rancher + catalog.cattle.io/display-name: UI Plugin Operator + catalog.cattle.io/kube-version: '>= 1.16.0-0 < 1.26.0-0' + catalog.cattle.io/namespace: cattle-ui-plugin-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux, windows + catalog.cattle.io/rancher-version: '>= 2.7.0-0 < 2.8.0-0' + catalog.cattle.io/release-name: ui-plugin-operator +apiVersion: v1 +appVersion: 0.1.0 +description: A UI Plugin Operator Chart for plugin management in Rancher +keywords: +- applications +- infrastructure +name: ui-plugin-operator +type: application +version: 101.0.1+up0.1.1-rc1 diff --git a/charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/templates/_helpers.tpl b/charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/templates/_helpers.tpl new file mode 100644 index 000000000..0d41d827f --- /dev/null +++ b/charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/templates/_helpers.tpl @@ -0,0 +1,89 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "ui-plugin-operator.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "ui-plugin-operator.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "ui-plugin-operator.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "ui-plugin-operator.labels" -}} +helm.sh/chart: {{ include "ui-plugin-operator.chart" . }} +{{ include "ui-plugin-operator.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "ui-plugin-operator.selectorLabels" -}} +app.kubernetes.io/name: {{ include "ui-plugin-operator.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "ui-plugin-operator.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "ui-plugin-operator.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{- define "system_default_registry" -}} +{{- if .Values.global.cattle.systemDefaultRegistry -}} +{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}} +{{- else -}} +{{- "" -}} +{{- end -}} +{{- end -}} + +{{/* +Windows cluster will add default taint for linux nodes, +add below linux tolerations to workloads could be scheduled to those linux nodes +*/}} +{{- define "linux-node-tolerations" -}} +- key: "cattle.io/os" + value: "linux" + effect: "NoSchedule" + operator: "Equal" +{{- end -}} + +{{- define "linux-node-selector" -}} +{{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}} +beta.kubernetes.io/os: linux +{{- else -}} +kubernetes.io/os: linux +{{- end -}} +{{- end -}} diff --git a/charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/templates/dashboardrole.yaml b/charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/templates/dashboardrole.yaml new file mode 100644 index 000000000..e8b7c456c --- /dev/null +++ b/charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/templates/dashboardrole.yaml @@ -0,0 +1,33 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ .Chart.Name }}-dashboard + namespace: {{ .Release.Namespace }} + labels: + app: {{ .Chart.Name }} +rules: +- apiGroups: + - "" + resources: + - services/proxy + resourceNames: + - "http:{{ .Chart.Name }}:{{ .Values.service.port }}" + - "https:{{ .Chart.Name }}:{{ .Values.service.port }}" + verbs: + - '*' +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ .Chart.Name }}-dashboard + namespace: {{ .Release.Namespace }} + labels: + app: {{ .Chart.Name }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ .Chart.Name }}-dashboard +subjects: +- kind: Group + name: system:authenticated + apiGroup: rbac.authorization.k8s.io diff --git a/charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/templates/deployment.yaml b/charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/templates/deployment.yaml new file mode 100644 index 000000000..b355b40ff --- /dev/null +++ b/charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/templates/deployment.yaml @@ -0,0 +1,67 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ .Chart.Name }} + labels: + {{- include "ui-plugin-operator.labels" . | nindent 4 }} +spec: + {{- if not .Values.autoscaling.enabled }} + replicas: {{ .Values.replicas }} + {{- end }} + selector: + matchLabels: + {{- include "ui-plugin-operator.selectorLabels" . | nindent 6 }} + template: + metadata: + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "ui-plugin-operator.selectorLabels" . | nindent 8 }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} +{{- if .Values.nodeSelector }} +{{ toYaml .Values.nodeSelector | indent 8 }} +{{- end }} + tolerations: {{ include "linux-node-tolerations" . | nindent 8 }} +{{- if .Values.tolerations }} +{{ toYaml .Values.tolerations | indent 8 }} +{{- end }} + serviceAccountName: {{ .Chart.Name }} + containers: + - name: {{ .Chart.Name }} + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + ports: + - name: http + containerPort: 80 + protocol: TCP + args: + - {{ template "ui-plugin-operator.name" . }} +{{- if .Values.debug }} + - --debug + - --debug-level={{ .Values.debugLevel }} +{{- end }} +{{- if .Values.additionalArgs }} +{{- toYaml .Values.additionalArgs | nindent 10 }} +{{- end }} + # livenessProbe: + # httpGet: + # path: / + # port: http + # readinessProbe: + # httpGet: + # path: / + # port: http + resources: + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/templates/hardened.yaml b/charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/templates/hardened.yaml new file mode 100644 index 000000000..0ca83aee7 --- /dev/null +++ b/charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/templates/hardened.yaml @@ -0,0 +1,123 @@ +{{- $namespaces := dict "_0" .Release.Namespace -}} +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ .Chart.Name }}-patch-sa + namespace: {{ .Release.Namespace }} + labels: + app: {{ .Chart.Name }}-patch-sa + annotations: + "helm.sh/hook": post-install, post-upgrade + "helm.sh/hook-delete-policy": hook-succeeded, before-hook-creation +spec: + template: + metadata: + name: {{ .Chart.Name }}-patch-sa + labels: + app: {{ .Chart.Name }}-patch-sa + spec: + serviceAccountName: {{ .Chart.Name }}-patch-sa + securityContext: + runAsNonRoot: true + runAsUser: 1000 + restartPolicy: Never + containers: + {{- range $_, $ns := $namespaces }} + - name: patch-sa-{{ $ns }} + image: {{ template "system_default_registry" $ }}{{ $.Values.global.kubectl.repository }}:{{ $.Values.global.kubectl.tag }} + imagePullPolicy: {{ $.Values.global.kubectl.pullPolicy }} + command: ["kubectl", "patch", "serviceaccount", "default", "-p", "{\"automountServiceAccountToken\": false}"] + args: ["-n", "{{ $ns }}"] + {{- end }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Chart.Name }}-patch-sa + labels: + app: {{ .Chart.Name }}-patch-sa +rules: +- apiGroups: + - "" + resources: + - serviceaccounts + verbs: ['get', 'patch'] +{{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicies" }} +- apiGroups: ['policy'] + resources: ['podsecuritypolicies'] + verbs: ['use'] + resourceNames: + - {{ .Chart.Name }}-patch-sa +{{- end }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ .Chart.Name }}-patch-sa + labels: + app: {{ .Chart.Name }}-patch-sa +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ .Chart.Name }}-patch-sa +subjects: +- kind: ServiceAccount + name: {{ .Chart.Name }}-patch-sa + namespace: {{ .Release.Namespace }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ .Chart.Name }}-patch-sa + namespace: {{ .Release.Namespace }} + labels: + app: {{ .Chart.Name }}-patch-sa +--- +{{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicies" }} +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: {{ .Chart.Name }}-patch-sa + namespace: {{ .Release.Namespace }} + labels: + app: {{ .Chart.Name }}-patch-sa +spec: + privileged: false + hostNetwork: false + hostIPC: false + hostPID: false + runAsUser: + rule: 'MustRunAsNonRoot' + seLinux: + rule: 'RunAsAny' + supplementalGroups: + rule: 'MustRunAs' + ranges: + - min: 1 + max: 65535 + fsGroup: + rule: 'MustRunAs' + ranges: + - min: 1 + max: 65535 + readOnlyRootFilesystem: false + volumes: + - 'secret' +{{- end }} +{{- range $_, $ns := $namespaces }} +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: default-allow-all + namespace: {{ $ns }} +spec: + podSelector: {} + ingress: + - {} + egress: + - {} + policyTypes: + - Ingress + - Egress +{{- end }} diff --git a/charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/templates/service.yaml b/charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/templates/service.yaml new file mode 100644 index 000000000..7c4e735e9 --- /dev/null +++ b/charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/templates/service.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ .Chart.Name }} + labels: + {{- include "ui-plugin-operator.labels" . | nindent 4 }} +spec: + type: {{ .Values.service.type }} + ports: + - port: {{ .Values.service.port }} + targetPort: {{ .Values.service.targetPort }} + protocol: TCP + name: http + selector: + {{- include "ui-plugin-operator.selectorLabels" . | nindent 4 }} diff --git a/charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/templates/serviceaccount.yaml b/charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/templates/serviceaccount.yaml new file mode 100644 index 000000000..89bb7a531 --- /dev/null +++ b/charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/templates/serviceaccount.yaml @@ -0,0 +1,101 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ .Chart.Name }} + namespace: {{ .Release.Namespace }} + labels: + app: {{ .Chart.Name }} +rules: +- apiGroups: [""] + resources: ["configmaps"] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ .Chart.Name }} + namespace: {{ .Release.Namespace }} + labels: + app: {{ .Chart.Name }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ .Chart.Name }} +subjects: +- kind: ServiceAccount + name: {{ .Chart.Name }} + namespace: {{ .Release.Namespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Chart.Name }} + namespace: {{ .Release.Namespace }} + labels: + app: {{ .Chart.Name }} +rules: +- apiGroups: ["catalog.cattle.io"] + resources: + - uiplugins + - uiplugins/status + verbs: ["*"] +- apiGroups: ["coordination.k8s.io"] + resources: + - leases + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ .Chart.Name }} + namespace: {{ .Release.Namespace }} + labels: + app: {{ .Chart.Name }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ .Chart.Name }} +subjects: +- kind: ServiceAccount + name: {{ .Chart.Name }} + namespace: {{ .Release.Namespace }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ .Chart.Name }} + namespace: {{ .Release.Namespace }} + labels: + app: {{ .Chart.Name }} +--- +{{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicies" }} +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: {{ .Chart.Name }} + namespace: {{ .Release.Namespace }} + labels: + app: {{ .Chart.Name }} +spec: + privileged: false + hostNetwork: false + hostIPC: false + hostPID: false + runAsUser: + rule: 'MustRunAsNonRoot' + seLinux: + rule: 'RunAsAny' + supplementalGroups: + rule: 'MustRunAs' + ranges: + - min: 1 + max: 65535 + fsGroup: + rule: 'MustRunAs' + ranges: + - min: 1 + max: 65535 + readOnlyRootFilesystem: false + volumes: + - 'secret' +{{- end }} diff --git a/charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/values.yaml b/charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/values.yaml new file mode 100644 index 000000000..cd7870dc1 --- /dev/null +++ b/charts/ui-plugin-operator/101.0.1+up0.1.1-rc1/values.yaml @@ -0,0 +1,67 @@ +# Default values for sample. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 + +image: + repository: rancher/ui-plugin-operator + pullPolicy: Always + tag: "v0.1.0" + +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + +service: + type: ClusterIP + port: 80 + targetPort: 8080 + +autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 100 + targetCPUUtilizationPercentage: 80 + +replicas: 1 + +resources: {} + +securityContext: + runAsNonRoot: true + runAsUser: 1000 + +nodeSelector: {} + +tolerations: [] + +affinity: {} + +podAnnotations: [] + +additionalArgs: [] + +global: + cattle: + systemDefaultRegistry: "" + kubectl: + repository: rancher/kubectl + tag: v1.20.2 + pullPolicy: IfNotPresent + rbac: + ## Create RBAC resources for ServiceAccounts and users + ## + enabled: false + # create: true + # userRoles: + # ## Create default user ClusterRoles to allow users to interact with Prometheus CRs, ConfigMaps, and Secrets + # create: true + # ## Aggregate default user ClusterRoles into default k8s ClusterRoles + # aggregateToDefaultRoles: true + + # pspEnabled: true + # pspAnnotations: {} + +debug: false +debugLevel: 0 diff --git a/index.yaml b/index.yaml index 25646f42f..088158a13 100755 --- a/index.yaml +++ b/index.yaml @@ -12629,6 +12629,29 @@ entries: - assets/system-upgrade-controller/system-upgrade-controller-100.0.0+up0.3.0.tgz version: 100.0.0+up0.3.0 ui-plugin-operator: + - annotations: + catalog.cattle.io/auto-install: ui-plugin-operator-crd=match + catalog.cattle.io/certified: rancher + catalog.cattle.io/display-name: UI Plugin Operator + catalog.cattle.io/kube-version: '>= 1.16.0-0 < 1.26.0-0' + catalog.cattle.io/namespace: cattle-ui-plugin-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux, windows + catalog.cattle.io/rancher-version: '>= 2.7.0-0 < 2.8.0-0' + catalog.cattle.io/release-name: ui-plugin-operator + apiVersion: v1 + appVersion: 0.1.0 + created: "2023-01-03T15:30:13.668781-08:00" + description: A UI Plugin Operator Chart for plugin management in Rancher + digest: 9fc0be33c51e057bebc87a8b854acffa7e30189cdf7c7908b60a79804d6ffa93 + keywords: + - applications + - infrastructure + name: ui-plugin-operator + type: application + urls: + - assets/ui-plugin-operator/ui-plugin-operator-101.0.1+up0.1.1-rc1.tgz + version: 101.0.1+up0.1.1-rc1 - annotations: catalog.cattle.io/auto-install: ui-plugin-operator-crd=match catalog.cattle.io/certified: rancher @@ -12653,6 +12676,20 @@ entries: - assets/ui-plugin-operator/ui-plugin-operator-101.0.0+up0.1.0.tgz version: 101.0.0+up0.1.0 ui-plugin-operator-crd: + - annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/namespace: cattle-ui-plugin-system + catalog.cattle.io/release-name: ui-plugin-operator-crd + apiVersion: v1 + created: "2023-01-03T15:30:13.669425-08:00" + description: Installs the CRDs for ui-plugin-operator. + digest: cdded409c1713f633eea59f8c0893c0d7a652eabd2ab72e75ce20e144be12e54 + name: ui-plugin-operator-crd + type: application + urls: + - assets/ui-plugin-operator-crd/ui-plugin-operator-crd-101.0.1+up0.1.1-rc1.tgz + version: 101.0.1+up0.1.1-rc1 - annotations: catalog.cattle.io/certified: rancher catalog.cattle.io/hidden: "true"