mirror of https://git.rancher.io/charts
[dev-v2.9] fleet 104.0.3+up0.10.3-rc.1 update (#4475)
Co-authored-by: fleet-bot <fleet@suse.de>pull/4478/head
Rancher Bot
GitHub
parent
cd5dd41784
commit
dd69e7c3eb
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
|
@ -0,0 +1,15 @@
|
|||
annotations:
|
||||
catalog.cattle.io/certified: rancher
|
||||
catalog.cattle.io/hidden: "true"
|
||||
catalog.cattle.io/kube-version: '>= 1.18.0-0 < 1.31.0-0'
|
||||
catalog.cattle.io/namespace: cattle-fleet-system
|
||||
catalog.cattle.io/os: linux
|
||||
catalog.cattle.io/permits-os: linux,windows
|
||||
catalog.cattle.io/rancher-version: '>= 2.9.0-0 < 2.10.0-0'
|
||||
catalog.cattle.io/release-name: fleet-agent
|
||||
apiVersion: v2
|
||||
appVersion: 0.10.3-rc.1
|
||||
description: Fleet Manager Agent - GitOps at Scale
|
||||
icon: https://charts.rancher.io/assets/logos/fleet.svg
|
||||
name: fleet-agent
|
||||
version: 104.0.3+up0.10.3-rc.1
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
## Fleet Agent Helm Chart
|
||||
|
||||
Every Fleet-managed downstream cluster will run an agent that communicates back to the Fleet controller. This agent is just another set of Kubernetes controllers running in the downstream cluster.
|
||||
|
||||
Standalone Fleet users use this chart for agent-initiated registration. For more details see [agent-initiated registration](https://fleet.rancher.io/cluster-registration#agent-initiated).
|
||||
Fleet in Rancher does not use this chart, but creates the agent deployments programmatically.
|
||||
|
||||
The Fleet documentation is centralized in the [doc website](https://fleet.rancher.io/).
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
{{- define "system_default_registry" -}}
|
||||
{{- if .Values.global.cattle.systemDefaultRegistry -}}
|
||||
{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}}
|
||||
{{- else -}}
|
||||
{{- "" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Windows cluster will add default taint for linux nodes,
|
||||
add below linux tolerations to workloads could be scheduled to those linux nodes
|
||||
*/}}
|
||||
{{- define "linux-node-tolerations" -}}
|
||||
- key: "cattle.io/os"
|
||||
value: "linux"
|
||||
effect: "NoSchedule"
|
||||
operator: "Equal"
|
||||
{{- end -}}
|
||||
|
||||
{{- define "linux-node-selector" -}}
|
||||
kubernetes.io/os: linux
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
kind: ConfigMap
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: fleet-agent
|
||||
data:
|
||||
config: |-
|
||||
{
|
||||
{{ if .Values.labels }}
|
||||
"labels":{{toJson .Values.labels}},
|
||||
{{ end }}
|
||||
"clientID":"{{.Values.clientID}}",
|
||||
"agentTLSMode": "{{.Values.agentTLSMode}}"
|
||||
{{ if .Values.garbageCollectionInterval }}
|
||||
"garbageCollectionInterval": "{{.Values.garbageCollectionInterval}}"
|
||||
{{ end }}
|
||||
}
|
||||
|
|
@ -0,0 +1,108 @@
|
|||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: fleet-agent
|
||||
spec:
|
||||
serviceName: fleet-agent
|
||||
selector:
|
||||
matchLabels:
|
||||
app: fleet-agent
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: fleet-agent
|
||||
spec:
|
||||
initContainers:
|
||||
- env:
|
||||
- name: NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
image: '{{ template "system_default_registry" . }}{{.Values.image.repository}}:{{.Values.image.tag}}'
|
||||
name: fleet-agent-register
|
||||
command:
|
||||
- fleetagent
|
||||
- register
|
||||
{{- if .Values.debug }}
|
||||
- --debug
|
||||
- --debug-level
|
||||
- {{ quote .Values.debugLevel }}
|
||||
{{- else }}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
privileged: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
{{- end }}
|
||||
containers:
|
||||
- env:
|
||||
- name: NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
image: '{{ template "system_default_registry" . }}{{.Values.image.repository}}:{{.Values.image.tag}}'
|
||||
name: fleet-agent
|
||||
command:
|
||||
- fleetagent
|
||||
{{- if .Values.debug }}
|
||||
- --debug
|
||||
- --debug-level
|
||||
- {{ quote .Values.debugLevel }}
|
||||
{{- else }}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
privileged: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- mountPath: /.kube
|
||||
name: kube
|
||||
- env:
|
||||
- name: NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
image: '{{ template "system_default_registry" . }}{{.Values.image.repository}}:{{.Values.image.tag}}'
|
||||
name: fleet-agent-clusterstatus
|
||||
command:
|
||||
- fleetagent
|
||||
- clusterstatus
|
||||
{{- if .Values.debug }}
|
||||
- --debug
|
||||
- --debug-level
|
||||
- {{ quote .Values.debugLevel }}
|
||||
{{- else }}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
privileged: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: kube
|
||||
emptyDir: {}
|
||||
serviceAccountName: fleet-agent
|
||||
{{- if .Values.fleetAgent.hostNetwork }}
|
||||
hostNetwork: true
|
||||
{{- end }}
|
||||
nodeSelector: {{ include "linux-node-selector" . | nindent 8 }}
|
||||
{{- if .Values.fleetAgent.nodeSelector }}
|
||||
{{ toYaml .Values.fleetAgent.nodeSelector | indent 8 }}
|
||||
{{- end }}
|
||||
tolerations: {{ include "linux-node-tolerations" . | nindent 8 }}
|
||||
{{- if .Values.fleetAgent.tolerations }}
|
||||
{{ toYaml .Values.fleetAgent.tolerations | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if not .Values.debug }}
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: default-allow-all
|
||||
namespace: {{ .Values.internal.systemNamespace }}
|
||||
spec:
|
||||
podSelector: {}
|
||||
ingress:
|
||||
- {}
|
||||
egress:
|
||||
- {}
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
|
|
@ -0,0 +1,28 @@
|
|||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: patch-fleet-sa
|
||||
annotations:
|
||||
"helm.sh/hook": post-install, post-upgrade
|
||||
"helm.sh/hook-delete-policy": hook-succeeded, before-hook-creation
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
serviceAccountName: fleet-agent
|
||||
restartPolicy: Never
|
||||
containers:
|
||||
- name: sa
|
||||
image: "{{ template "system_default_registry" . }}{{ .Values.global.kubectl.repository }}:{{ .Values.global.kubectl.tag }}"
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
|
||||
command: ["kubectl", "patch", "serviceaccount", "default", "-p", "{\"automountServiceAccountToken\": false}"]
|
||||
args: ["-n", {{ .Values.internal.systemNamespace }}]
|
||||
nodeSelector: {{ include "linux-node-selector" . | nindent 8 }}
|
||||
{{- if .Values.kubectl.nodeSelector }}
|
||||
{{ toYaml .Values.kubectl.nodeSelector | indent 8 }}
|
||||
{{- end }}
|
||||
tolerations: {{ include "linux-node-tolerations" . | nindent 8 }}
|
||||
{{- if .Values.kubectl.tolerations }}
|
||||
{{ toYaml .Values.kubectl.tolerations | indent 8 }}
|
||||
{{- end }}
|
||||
backoffLimit: 1
|
||||
|
|
@ -0,0 +1,28 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: fleet-agent-system-fleet-agent-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- '*'
|
||||
resources:
|
||||
- '*'
|
||||
verbs:
|
||||
- '*'
|
||||
- nonResourceURLs:
|
||||
- "*"
|
||||
verbs:
|
||||
- "*"
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: fleet-agent-system-fleet-agent-role-binding
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: fleet-agent-system-fleet-agent-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: fleet-agent
|
||||
namespace: {{.Release.Namespace}}
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
apiVersion: v1
|
||||
data:
|
||||
systemRegistrationNamespace: "{{b64enc .Values.systemRegistrationNamespace}}"
|
||||
clusterNamespace: "{{b64enc .Values.clusterNamespace}}"
|
||||
token: "{{b64enc .Values.token}}"
|
||||
apiServerURL: "{{b64enc .Values.apiServerURL}}"
|
||||
apiServerCA: "{{b64enc .Values.apiServerCA}}"
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: fleet-agent-bootstrap
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: fleet-agent
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
selector:
|
||||
app: fleet-agent
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: fleet-agent
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
{{if ne .Release.Namespace .Values.internal.systemNamespace }}
|
||||
{{ fail (printf "This chart must be installed in the namespace %s as the release name fleet-agent" .Values.internal.systemNamespace) }}
|
||||
{{end}}
|
||||
|
||||
{{if ne .Release.Name .Values.internal.managedReleaseName }}
|
||||
{{ fail (printf "This chart must be installed in the namespace %s as the release name fleet-agent" .Values.internal.managedReleaseName) }}
|
||||
{{end}}
|
||||
|
||||
{{if not .Values.apiServerURL }}
|
||||
{{ fail "apiServerURL is required to be set, and most likely also apiServerCA" }}
|
||||
{{end}}
|
||||
|
|
@ -0,0 +1,70 @@
|
|||
image:
|
||||
os: "windows,linux"
|
||||
repository: rancher/fleet-agent
|
||||
tag: v0.10.3-rc.1
|
||||
|
||||
# The public URL of the Kubernetes API server running the Fleet Manager must be set here
|
||||
# Example: https://example.com:6443
|
||||
apiServerURL: ""
|
||||
|
||||
# The the pem encoded value of the CA of the Kubernetes API server running the Fleet Manager.
|
||||
# If left empty it is assumed this Kubernetes API TLS is signed by a well known CA.
|
||||
apiServerCA: ""
|
||||
|
||||
# Determines whether the agent should trust CA bundles from the operating system's trust store when connecting to a
|
||||
# management cluster. True in `system-store` mode, false in `strict` mode.
|
||||
agentTLSMode: "system-store"
|
||||
|
||||
# The cluster registration value
|
||||
token: ""
|
||||
|
||||
# Labels to add to the cluster upon registration only. They are not added after the fact.
|
||||
# labels:
|
||||
# foo: bar
|
||||
|
||||
# The client ID of the cluster to associate with
|
||||
clientID: ""
|
||||
|
||||
# The namespace of the cluster we are register with
|
||||
clusterNamespace: ""
|
||||
|
||||
# The namespace containing the clusters registration secrets
|
||||
systemRegistrationNamespace: cattle-fleet-clusters-system
|
||||
|
||||
# Please do not change the below setting unless you really know what you are doing
|
||||
internal:
|
||||
systemNamespace: cattle-fleet-system
|
||||
managedReleaseName: fleet-agent
|
||||
|
||||
# The nodeSelector and tolerations for the agent deployment
|
||||
fleetAgent:
|
||||
## Node labels for pod assignment
|
||||
## Ref: https://kubernetes.io/docs/user-guide/node-selection/
|
||||
##
|
||||
nodeSelector: {}
|
||||
## List of node taints to tolerate (requires Kubernetes >= 1.6)
|
||||
tolerations: []
|
||||
## HostNetwork setting for the agent deployment.
|
||||
## When set allows for provisioning of network related bundles (CNI configuration) in a cluster without CNI.
|
||||
hostNetwork: false
|
||||
kubectl:
|
||||
## Node labels for pod assignment
|
||||
## Ref: https://kubernetes.io/docs/user-guide/node-selection/
|
||||
##
|
||||
nodeSelector: {}
|
||||
## List of node taints to tolerate (requires Kubernetes >= 1.6)
|
||||
tolerations:
|
||||
- key: node.cloudprovider.kubernetes.io/uninitialized
|
||||
operator: "Equal"
|
||||
value: "true"
|
||||
effect: NoSchedule
|
||||
|
||||
global:
|
||||
cattle:
|
||||
systemDefaultRegistry: ""
|
||||
kubectl:
|
||||
repository: rancher/kubectl
|
||||
tag: v1.29.0
|
||||
|
||||
debug: false
|
||||
debugLevel: 0
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
annotations:
|
||||
catalog.cattle.io/certified: rancher
|
||||
catalog.cattle.io/hidden: "true"
|
||||
catalog.cattle.io/namespace: cattle-fleet-system
|
||||
catalog.cattle.io/os: linux
|
||||
catalog.cattle.io/permits-os: linux,windows
|
||||
catalog.cattle.io/release-name: fleet-crd
|
||||
apiVersion: v2
|
||||
appVersion: 0.10.3-rc.1
|
||||
description: Fleet Manager CustomResourceDefinitions
|
||||
icon: https://charts.rancher.io/assets/logos/fleet.svg
|
||||
name: fleet-crd
|
||||
version: 104.0.3+up0.10.3-rc.1
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
# Fleet CRD Helm Chart
|
||||
|
||||
Fleet Manager CustomResourceDefinitions Helm chart is a requirement for the Fleet Helm Chart.
|
||||
|
||||
The Fleet documentation is centralized in the [doc website](https://fleet.rancher.io/).
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1 @@
|
|||
# This file is intentionally empty
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
annotations:
|
||||
catalog.cattle.io/auto-install: fleet-crd=match
|
||||
catalog.cattle.io/certified: rancher
|
||||
catalog.cattle.io/experimental: "true"
|
||||
catalog.cattle.io/hidden: "true"
|
||||
catalog.cattle.io/kube-version: '>= 1.18.0-0 < 1.31.0-0'
|
||||
catalog.cattle.io/namespace: cattle-fleet-system
|
||||
catalog.cattle.io/os: linux
|
||||
catalog.cattle.io/permits-os: linux,windows
|
||||
catalog.cattle.io/provides-gvr: clusters.fleet.cattle.io/v1alpha1
|
||||
catalog.cattle.io/rancher-version: '>= 2.9.0-0 < 2.10.0-0'
|
||||
catalog.cattle.io/release-name: fleet
|
||||
apiVersion: v2
|
||||
appVersion: 0.10.3-rc.1
|
||||
description: Fleet Manager - GitOps at Scale
|
||||
icon: https://charts.rancher.io/assets/logos/fleet.svg
|
||||
name: fleet
|
||||
version: 104.0.3+up0.10.3-rc.1
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
# Fleet Helm Chart
|
||||
|
||||
Fleet is GitOps at scale. Fleet is designed to manage multiple clusters.
|
||||
|
||||
## What is Fleet?
|
||||
|
||||
* Cluster engine: Fleet is a container management and deployment engine designed to offer users more control on the local cluster and constant monitoring through GitOps. Fleet focuses not only on the ability to scale, but it also gives users a high degree of control and visibility to monitor exactly what is installed on the cluster.
|
||||
|
||||
* Deployment management: Fleet can manage deployments from git of raw Kubernetes YAML, Helm charts, Kustomize, or any combination of the three. Regardless of the source, all resources are dynamically turned into Helm charts, and Helm is used as the engine to deploy all resources in the cluster. As a result, users can enjoy a high degree of control, consistency, and auditability of their clusters.
|
||||
|
||||
## Introduction
|
||||
|
||||
This chart deploys Fleet on a Kubernetes cluster. It also deploys some of its dependencies as subcharts.
|
||||
|
||||
The documentation is centralized in the [doc website](https://fleet.rancher.io/).
|
||||
|
||||
## Prerequisites
|
||||
|
||||
Get helm if you don't have it. Helm 3 is just a CLI.
|
||||
|
||||
|
||||
## Install Fleet
|
||||
|
||||
Install the Fleet Helm charts (there are two because we separate out CRDs for ultimate flexibility.):
|
||||
|
||||
```
|
||||
$ helm repo add fleet https://rancher.github.io/fleet-helm-charts/
|
||||
$ helm -n cattle-fleet-system install --create-namespace --wait fleet-crd fleet/fleet-crd
|
||||
$ helm -n cattle-fleet-system install --create-namespace --wait fleet fleet/fleet
|
||||
```
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
{{- define "system_default_registry" -}}
|
||||
{{- if .Values.global.cattle.systemDefaultRegistry -}}
|
||||
{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}}
|
||||
{{- else -}}
|
||||
{{- "" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Windows cluster will add default taint for linux nodes,
|
||||
add below linux tolerations to workloads could be scheduled to those linux nodes
|
||||
*/}}
|
||||
{{- define "linux-node-tolerations" -}}
|
||||
- key: "cattle.io/os"
|
||||
value: "linux"
|
||||
effect: "NoSchedule"
|
||||
operator: "Equal"
|
||||
{{- end -}}
|
||||
|
||||
{{- define "linux-node-selector" -}}
|
||||
kubernetes.io/os: linux
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: fleet-controller
|
||||
data:
|
||||
config: |
|
||||
{
|
||||
"systemDefaultRegistry": "{{ template "system_default_registry" . }}",
|
||||
"agentImage": "{{ template "system_default_registry" . }}{{.Values.agentImage.repository}}:{{.Values.agentImage.tag}}",
|
||||
"agentImagePullPolicy": "{{ .Values.agentImage.imagePullPolicy }}",
|
||||
"apiServerURL": "{{.Values.apiServerURL}}",
|
||||
"apiServerCA": "{{b64enc .Values.apiServerCA}}",
|
||||
"agentCheckinInterval": "{{.Values.agentCheckinInterval}}",
|
||||
"agentTLSMode": "{{.Values.agentTLSMode}}",
|
||||
{{ if .Values.garbageCollectionInterval }}
|
||||
"garbageCollectionInterval": "{{.Values.garbageCollectionInterval}}",
|
||||
{{ end }}
|
||||
"ignoreClusterRegistrationLabels": {{.Values.ignoreClusterRegistrationLabels}},
|
||||
"bootstrap": {
|
||||
"paths": "{{.Values.bootstrap.paths}}",
|
||||
"repo": "{{.Values.bootstrap.repo}}",
|
||||
"secret": "{{.Values.bootstrap.secret}}",
|
||||
"branch": "{{.Values.bootstrap.branch}}",
|
||||
"namespace": "{{.Values.bootstrap.namespace}}",
|
||||
"agentNamespace": "{{.Values.bootstrap.agentNamespace}}"
|
||||
},
|
||||
"webhookReceiverURL": "{{.Values.webhookReceiverURL}}",
|
||||
"githubURLPrefix": "{{.Values.githubURLPrefix}}"
|
||||
}
|
||||
|
|
@ -0,0 +1,255 @@
|
|||
{{- $shards := list (dict "id" "" "nodeSelector" dict) -}}
|
||||
{{- $uniqueShards := list -}}
|
||||
{{- if .Values.shards -}}
|
||||
{{- range .Values.shards -}}
|
||||
{{- if not (has .id $uniqueShards) -}}
|
||||
{{- $shards = append $shards . -}}
|
||||
{{- $uniqueShards = append $uniqueShards .id -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{ range $shard := $shards }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: "fleet-controller{{if $shard.id }}-shard-{{ $shard.id }}{{end}}"
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: fleet-controller
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: fleet-controller
|
||||
fleet.cattle.io/shard-id: "{{ $shard.id }}"
|
||||
{{- if empty $shard.id }}
|
||||
fleet.cattle.io/shard-default: "true"
|
||||
{{- end }}
|
||||
spec:
|
||||
containers:
|
||||
- env:
|
||||
- name: NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
{{- if $.Values.clusterEnqueueDelay }}
|
||||
- name: FLEET_CLUSTER_ENQUEUE_DELAY
|
||||
value: {{ $.Values.clusterEnqueueDelay }}
|
||||
{{- end }}
|
||||
{{- if $.Values.proxy }}
|
||||
- name: HTTP_PROXY
|
||||
value: {{ $.Values.proxy }}
|
||||
- name: HTTPS_PROXY
|
||||
value: {{ $.Values.proxy }}
|
||||
- name: NO_PROXY
|
||||
value: {{ $.Values.noProxy }}
|
||||
{{- end }}
|
||||
{{- if $.Values.cpuPprof }}
|
||||
- name: FLEET_CPU_PPROF_DIR
|
||||
value: /tmp/pprof/
|
||||
{{- end }}
|
||||
{{- if $.Values.cpuPprof }}
|
||||
- name: FLEET_CPU_PPROF_PERIOD
|
||||
value: {{ quote $.Values.cpuPprof.period }}
|
||||
{{- end }}
|
||||
{{- if $.Values.leaderElection.leaseDuration }}
|
||||
- name: CATTLE_ELECTION_LEASE_DURATION
|
||||
value: {{$.Values.leaderElection.leaseDuration}}
|
||||
{{- end }}
|
||||
{{- if $.Values.leaderElection.retryPeriod }}
|
||||
- name: CATTLE_ELECTION_RETRY_PERIOD
|
||||
value: {{$.Values.leaderElection.retryPeriod}}
|
||||
{{- end }}
|
||||
{{- if $.Values.leaderElection.renewDeadline }}
|
||||
- name: CATTLE_ELECTION_RENEW_DEADLINE
|
||||
value: {{$.Values.leaderElection.renewDeadline}}
|
||||
{{- end }}
|
||||
{{- if $.Values.debug }}
|
||||
- name: CATTLE_DEV_MODE
|
||||
value: "true"
|
||||
{{- end }}
|
||||
{{- if $.Values.controller.reconciler.workers.gitrepo }}
|
||||
- name: GITREPO_RECONCILER_WORKERS
|
||||
value: {{ quote $.Values.controller.reconciler.workers.gitrepo }}
|
||||
{{- end }}
|
||||
{{- if $.Values.controller.reconciler.workers.bundle }}
|
||||
- name: BUNDLE_RECONCILER_WORKERS
|
||||
value: {{ quote $.Values.controller.reconciler.workers.bundle }}
|
||||
{{- end }}
|
||||
{{- if $.Values.controller.reconciler.workers.bundledeployment }}
|
||||
- name: BUNDLEDEPLOYMENT_RECONCILER_WORKERS
|
||||
value: {{ quote $.Values.controller.reconciler.workers.bundledeployment }}
|
||||
{{- end }}
|
||||
{{- if $.Values.extraEnv }}
|
||||
{{ toYaml $.Values.extraEnv | indent 8}}
|
||||
{{- end }}
|
||||
image: '{{ template "system_default_registry" $ }}{{ $.Values.image.repository }}:{{ $.Values.image.tag }}'
|
||||
name: fleet-controller
|
||||
imagePullPolicy: "{{ $.Values.image.imagePullPolicy }}"
|
||||
{{- if $.Values.metrics.enabled }}
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: metrics
|
||||
{{- end }}
|
||||
command:
|
||||
- fleetcontroller
|
||||
{{- if $shard.id }}
|
||||
- --shard-id
|
||||
- {{ quote $shard.id }}
|
||||
{{- end }}
|
||||
{{- if not $.Values.metrics.enabled }}
|
||||
- --disable-metrics
|
||||
{{- end }}
|
||||
{{- if $.Values.debug }}
|
||||
- --debug
|
||||
- --debug-level
|
||||
- {{ quote $.Values.debugLevel }}
|
||||
{{- else }}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
privileged: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- mountPath: /tmp
|
||||
name: tmp
|
||||
{{- if $.Values.cpuPprof }}
|
||||
- mountPath: /tmp/pprof
|
||||
name: pprof
|
||||
{{- end }}
|
||||
{{- if not $shard.id }} # Only deploy cleanup and agent management through sharding-less deployment
|
||||
- env:
|
||||
- name: NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
{{- if $.Values.debug }}
|
||||
- name: CATTLE_DEV_MODE
|
||||
value: "true"
|
||||
{{- end }}
|
||||
{{- if $.Values.leaderElection.leaseDuration }}
|
||||
- name: CATTLE_ELECTION_LEASE_DURATION
|
||||
value: {{$.Values.leaderElection.leaseDuration}}
|
||||
{{- end }}
|
||||
{{- if $.Values.leaderElection.retryPeriod }}
|
||||
- name: CATTLE_ELECTION_RETRY_PERIOD
|
||||
value: {{$.Values.leaderElection.retryPeriod}}
|
||||
{{- end }}
|
||||
{{- if $.Values.leaderElection.renewDeadline }}
|
||||
- name: CATTLE_ELECTION_RENEW_DEADLINE
|
||||
value: {{$.Values.leaderElection.renewDeadline}}
|
||||
{{- end }}
|
||||
{{- if $.Values.controller.reconciler.workers.gitrepo }}
|
||||
- name: GITREPO_RECONCILER_WORKERS
|
||||
value: {{ quote $.Values.controller.reconciler.workers.gitrepo }}
|
||||
{{- end }}
|
||||
{{- if $.Values.controller.reconciler.workers.bundle }}
|
||||
- name: BUNDLE_RECONCILER_WORKERS
|
||||
value: {{ quote $.Values.controller.reconciler.workers.bundle }}
|
||||
{{- end }}
|
||||
{{- if $.Values.controller.reconciler.workers.bundledeployment }}
|
||||
- name: BUNDLEDEPLOYMENT_RECONCILER_WORKERS
|
||||
value: {{ quote $.Values.controller.reconciler.workers.bundledeployment }}
|
||||
{{- end }}
|
||||
image: '{{ template "system_default_registry" $ }}{{ $.Values.image.repository }}:{{ $.Values.image.tag }}'
|
||||
name: fleet-cleanup
|
||||
imagePullPolicy: "{{ $.Values.image.imagePullPolicy }}"
|
||||
command:
|
||||
- fleetcontroller
|
||||
- cleanup
|
||||
{{- if $.Values.debug }}
|
||||
- --debug
|
||||
- --debug-level
|
||||
- {{ quote $.Values.debugLevel }}
|
||||
{{- else }}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
privileged: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
{{- end }}
|
||||
- env:
|
||||
- name: NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: FLEET_PROPAGATE_DEBUG_SETTINGS_TO_AGENTS
|
||||
value: {{ quote $.Values.propagateDebugSettingsToAgents }}
|
||||
{{- if $.Values.debug }}
|
||||
- name: CATTLE_DEV_MODE
|
||||
value: "true"
|
||||
{{- end }}
|
||||
{{- if $.Values.leaderElection.leaseDuration }}
|
||||
- name: CATTLE_ELECTION_LEASE_DURATION
|
||||
value: {{$.Values.leaderElection.leaseDuration}}
|
||||
{{- end }}
|
||||
{{- if $.Values.leaderElection.retryPeriod }}
|
||||
- name: CATTLE_ELECTION_RETRY_PERIOD
|
||||
value: {{$.Values.leaderElection.retryPeriod}}
|
||||
{{- end }}
|
||||
{{- if $.Values.leaderElection.renewDeadline }}
|
||||
- name: CATTLE_ELECTION_RENEW_DEADLINE
|
||||
value: {{$.Values.leaderElection.renewDeadline}}
|
||||
{{- end }}
|
||||
image: '{{ template "system_default_registry" $ }}{{ $.Values.image.repository }}:{{ $.Values.image.tag }}'
|
||||
name: fleet-agentmanagement
|
||||
imagePullPolicy: "{{ $.Values.image.imagePullPolicy }}"
|
||||
command:
|
||||
- fleetcontroller
|
||||
- agentmanagement
|
||||
{{- if not $.Values.bootstrap.enabled }}
|
||||
- --disable-bootstrap
|
||||
{{- end }}
|
||||
{{- if $.Values.debug }}
|
||||
- --debug
|
||||
- --debug-level
|
||||
- {{ quote $.Values.debugLevel }}
|
||||
{{- else }}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
privileged: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: tmp
|
||||
emptyDir: {}
|
||||
{{- if $.Values.cpuPprof }}
|
||||
- name: pprof {{ toYaml $.Values.cpuPprof.volumeConfiguration | nindent 10 }}
|
||||
{{- end }}
|
||||
|
||||
serviceAccountName: fleet-controller
|
||||
nodeSelector: {{ include "linux-node-selector" $shard.id | nindent 8 }}
|
||||
{{- if $.Values.nodeSelector }}
|
||||
{{ toYaml $.Values.nodeSelector | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if $shard.nodeSelector -}}
|
||||
{{- range $key, $value := $shard.nodeSelector }}
|
||||
{{ $key | indent 8}}: {{ $value }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
tolerations: {{ include "linux-node-tolerations" $shard.id | nindent 8 }}
|
||||
{{- if $.Values.tolerations }}
|
||||
{{ toYaml $.Values.tolerations | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if $.Values.priorityClassName }}
|
||||
priorityClassName: "{{$.Values.priorityClassName}}"
|
||||
{{- end }}
|
||||
|
||||
{{- if not $.Values.debug }}
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,136 @@
|
|||
{{- $shards := list (dict "id" "" "nodeSelector" dict) -}}
|
||||
{{- $uniqueShards := list -}}
|
||||
{{- if .Values.shards -}}
|
||||
{{- range .Values.shards -}}
|
||||
{{- if not (has .id $uniqueShards) -}}
|
||||
{{- $shards = append $shards . -}}
|
||||
{{- $uniqueShards = append $uniqueShards .id -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{ range $shard := $shards }}
|
||||
{{- if $.Values.gitops.enabled }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: "gitjob{{if $shard.id }}-shard-{{ $shard.id }}{{end}}"
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: "gitjob"
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: "gitjob"
|
||||
fleet.cattle.io/shard-id: "{{ $shard.id }}"
|
||||
{{- if empty $shard.id }}
|
||||
fleet.cattle.io/shard-default: "true"
|
||||
{{- end }}
|
||||
spec:
|
||||
serviceAccountName: gitjob
|
||||
containers:
|
||||
- image: "{{ template "system_default_registry" $ }}{{ $.Values.image.repository }}:{{ $.Values.image.tag }}"
|
||||
name: gitjob
|
||||
{{- if $.Values.metrics.enabled }}
|
||||
ports:
|
||||
- containerPort: 8081
|
||||
name: metrics
|
||||
{{- end }}
|
||||
args:
|
||||
- fleetcontroller
|
||||
- gitjob
|
||||
- --gitjob-image
|
||||
- "{{ template "system_default_registry" $ }}{{ $.Values.image.repository }}:{{ $.Values.image.tag }}"
|
||||
{{- if $.Values.debug }}
|
||||
- --debug
|
||||
- --debug-level
|
||||
- {{ quote $.Values.debugLevel }}
|
||||
{{- end }}
|
||||
{{- if $shard.id }}
|
||||
- --shard-id
|
||||
- {{ quote $shard.id }}
|
||||
{{- end }}
|
||||
{{- if $shard.nodeSelector }}
|
||||
- --shard-node-selector
|
||||
- {{ toJson $shard.nodeSelector | squote }}
|
||||
{{- end }}
|
||||
{{- if not $.Values.metrics.enabled }}
|
||||
- --disable-metrics
|
||||
{{- end }}
|
||||
env:
|
||||
- name: NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
{{- if $.Values.leaderElection.leaseDuration }}
|
||||
- name: CATTLE_ELECTION_LEASE_DURATION
|
||||
value: {{$.Values.leaderElection.leaseDuration}}
|
||||
{{- end }}
|
||||
{{- if $.Values.leaderElection.retryPeriod }}
|
||||
- name: CATTLE_ELECTION_RETRY_PERIOD
|
||||
value: {{$.Values.leaderElection.retryPeriod}}
|
||||
{{- end }}
|
||||
{{- if $.Values.leaderElection.renewDeadline }}
|
||||
- name: CATTLE_ELECTION_RENEW_DEADLINE
|
||||
value: {{$.Values.leaderElection.renewDeadline}}
|
||||
{{- end }}
|
||||
{{- if $.Values.proxy }}
|
||||
- name: HTTP_PROXY
|
||||
value: {{ $.Values.proxy }}
|
||||
- name: HTTPS_PROXY
|
||||
value: {{ $.Values.proxy }}
|
||||
- name: NO_PROXY
|
||||
value: {{ $.Values.noProxy }}
|
||||
{{- end }}
|
||||
{{- if $.Values.controller.reconciler.workers.gitrepo }}
|
||||
- name: GITREPO_RECONCILER_WORKERS
|
||||
value: {{ quote $.Values.controller.reconciler.workers.gitrepo }}
|
||||
{{- end }}
|
||||
{{- if $.Values.extraEnv }}
|
||||
{{ toYaml $.Values.extraEnv | indent 12}}
|
||||
{{- end }}
|
||||
{{- if $.Values.debug }}
|
||||
- name: CATTLE_DEV_MODE
|
||||
value: "true"
|
||||
{{- else }}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
privileged: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- mountPath: /tmp
|
||||
name: tmp
|
||||
nodeSelector: {{ include "linux-node-selector" $shard.id | nindent 8 }}
|
||||
{{- if $.Values.nodeSelector }}
|
||||
{{ toYaml $.Values.nodeSelector | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if $shard.nodeSelector -}}
|
||||
{{- range $key, $value := $shard.nodeSelector }}
|
||||
{{ $key | indent 8}}: {{ $value }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
tolerations: {{ include "linux-node-tolerations" $shard.id | nindent 8 }}
|
||||
{{- if $.Values.tolerations }}
|
||||
{{ toYaml $.Values.tolerations | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if $.Values.priorityClassName }}
|
||||
priorityClassName: "{{$.Values.priorityClassName}}"
|
||||
{{- end }}
|
||||
|
||||
{{- if not $.Values.debug }}
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: tmp
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
{{- if .Values.migrations.clusterRegistrationCleanup }}
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: fleet-cleanup-clusterregistrations
|
||||
annotations:
|
||||
"helm.sh/hook": post-install, post-upgrade
|
||||
"helm.sh/hook-delete-policy": hook-succeeded, before-hook-creation
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: fleet-job
|
||||
spec:
|
||||
serviceAccountName: fleet-controller
|
||||
restartPolicy: Never
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsGroup: 1000
|
||||
runAsUser: 1000
|
||||
containers:
|
||||
- name: cleanup
|
||||
image: "{{ template "system_default_registry" . }}{{.Values.image.repository}}:{{.Values.image.tag}}"
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: false
|
||||
privileged: false
|
||||
command:
|
||||
- fleet
|
||||
args:
|
||||
- cleanup
|
||||
nodeSelector: {{ include "linux-node-selector" . | nindent 8 }}
|
||||
tolerations: {{ include "linux-node-tolerations" . | nindent 8 }}
|
||||
backoffLimit: 1
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,114 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: fleet-controller
|
||||
rules:
|
||||
- apiGroups:
|
||||
- fleet.cattle.io
|
||||
resources:
|
||||
- '*'
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- namespaces
|
||||
- serviceaccounts
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
- configmaps
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- clusterroles
|
||||
- clusterrolebindings
|
||||
- roles
|
||||
- rolebindings
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- 'events'
|
||||
verbs:
|
||||
- '*'
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: fleet-controller
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: fleet-controller
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: fleet-controller
|
||||
namespace: {{.Release.Namespace}}
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: fleet-controller
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- '*'
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: fleet-controller
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: fleet-controller
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: fleet-controller
|
||||
|
||||
{{- if .Values.bootstrap.enabled }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: fleet-controller-bootstrap
|
||||
rules:
|
||||
- apiGroups:
|
||||
- '*'
|
||||
resources:
|
||||
- '*'
|
||||
verbs:
|
||||
- '*'
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: fleet-controller-bootstrap
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: fleet-controller-bootstrap
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: fleet-controller-bootstrap
|
||||
namespace: {{.Release.Namespace}}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,133 @@
|
|||
{{- if .Values.gitops.enabled }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: gitjob
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "batch"
|
||||
resources:
|
||||
- 'jobs'
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- 'pods'
|
||||
verbs:
|
||||
- 'list'
|
||||
- 'get'
|
||||
- 'watch'
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- 'secrets'
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- 'configmaps'
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- "fleet.cattle.io"
|
||||
resources:
|
||||
- "gitrepos"
|
||||
- "gitrepos/status"
|
||||
verbs:
|
||||
- "*"
|
||||
- apiGroups:
|
||||
- "fleet.cattle.io"
|
||||
resources:
|
||||
- "gitreporestrictions"
|
||||
verbs:
|
||||
- list
|
||||
- get
|
||||
- watch
|
||||
- apiGroups:
|
||||
- "fleet.cattle.io"
|
||||
resources:
|
||||
- "bundles"
|
||||
- "bundledeployments"
|
||||
- "imagescans"
|
||||
- "contents"
|
||||
verbs:
|
||||
- list
|
||||
- delete
|
||||
- get
|
||||
- watch
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- 'events'
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- serviceaccounts
|
||||
verbs:
|
||||
- "create"
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- namespaces
|
||||
verbs:
|
||||
- "create"
|
||||
- "delete"
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- roles
|
||||
verbs:
|
||||
- escalate
|
||||
- create
|
||||
- bind
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- rolebindings
|
||||
verbs:
|
||||
- create
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: gitjob-binding
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: gitjob
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: gitjob
|
||||
namespace: {{ .Release.Namespace }}
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: gitjob
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "coordination.k8s.io"
|
||||
resources:
|
||||
- "leases"
|
||||
verbs:
|
||||
- "*"
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: gitjob
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: gitjob
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: gitjob
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,36 @@
|
|||
{{- if .Values.metrics.enabled }}
|
||||
{{- $shards := list (dict "id" "" "nodeSelector" dict) -}}
|
||||
{{- $uniqueShards := list -}}
|
||||
{{- if .Values.shards -}}
|
||||
{{- range .Values.shards -}}
|
||||
{{- if not (has .id $uniqueShards) -}}
|
||||
{{- $shards = append $shards . -}}
|
||||
{{- $uniqueShards = append $uniqueShards .id -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{ range $shard := $shards }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: "monitoring-fleet-controller{{if $shard.id }}-shard-{{ $shard.id }}{{end}}"
|
||||
labels:
|
||||
app: fleet-controller
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- port: 8080
|
||||
targetPort: 8080
|
||||
protocol: TCP
|
||||
name: metrics
|
||||
selector:
|
||||
app: fleet-controller
|
||||
{{- if empty $shard.id }}
|
||||
fleet.cattle.io/shard-default: "true"
|
||||
{{- else }}
|
||||
fleet.cattle.io/shard-id: "{{ $shard.id }}"
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,51 @@
|
|||
{{- if .Values.gitops.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: gitjob
|
||||
spec:
|
||||
ports:
|
||||
- name: http-80
|
||||
port: 80
|
||||
protocol: TCP
|
||||
targetPort: 8080
|
||||
selector:
|
||||
app: "gitjob"
|
||||
---
|
||||
{{- if .Values.metrics.enabled }}
|
||||
{{- $shards := list (dict "id" "" "nodeSelector" dict) -}}
|
||||
{{- $uniqueShards := list -}}
|
||||
{{- if .Values.shards -}}
|
||||
{{- range .Values.shards -}}
|
||||
{{- if not (has .id $uniqueShards) -}}
|
||||
{{- $shards = append $shards . -}}
|
||||
{{- $uniqueShards = append $uniqueShards .id -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{ range $shard := $shards }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: "monitoring-gitjob{{if $shard.id }}-shard-{{ $shard.id }}{{end}}"
|
||||
labels:
|
||||
app: gitjob
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- port: 8081
|
||||
targetPort: 8081
|
||||
protocol: TCP
|
||||
name: metrics
|
||||
selector:
|
||||
app: gitjob
|
||||
{{- if empty $shard.id }}
|
||||
fleet.cattle.io/shard-default: "true"
|
||||
{{- else }}
|
||||
fleet.cattle.io/shard-id: "{{ $shard.id }}"
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: fleet-controller
|
||||
|
||||
{{- if .Values.bootstrap.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: fleet-controller-bootstrap
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
{{- if .Values.gitops.enabled }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: gitjob
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,120 @@
|
|||
image:
|
||||
repository: rancher/fleet
|
||||
tag: v0.10.3-rc.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
|
||||
agentImage:
|
||||
repository: rancher/fleet-agent
|
||||
tag: v0.10.3-rc.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
|
||||
# For cluster registration the public URL of the Kubernetes API server must be set here
|
||||
# Example: https://example.com:6443
|
||||
apiServerURL: ""
|
||||
|
||||
# For cluster registration the pem encoded value of the CA of the Kubernetes API server must be set here
|
||||
# If left empty it is assumed this Kubernetes API TLS is signed by a well known CA.
|
||||
apiServerCA: ""
|
||||
|
||||
# Determines whether the agent should trust CA bundles from the operating system's trust store when connecting to a
|
||||
# management cluster. True in `system-store` mode, false in `strict` mode.
|
||||
agentTLSMode: "system-store"
|
||||
|
||||
# A duration string for how often agents should report a heartbeat
|
||||
agentCheckinInterval: "15m"
|
||||
|
||||
# Whether you want to allow cluster upon registration to specify their labels.
|
||||
ignoreClusterRegistrationLabels: false
|
||||
|
||||
# Counts from gitrepo are out of sync with bundleDeployment state.
|
||||
# Just retry in a number of seconds as there is no great way to trigger an event that doesn't cause a loop.
|
||||
# If not set default is 15 seconds.
|
||||
# clusterEnqueueDelay: 120s
|
||||
|
||||
# http[s] proxy server
|
||||
# proxy: http://<username>@<password>:<url>:<port>
|
||||
|
||||
# comma separated list of domains or ip addresses that will not use the proxy
|
||||
noProxy: 127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.cluster.local
|
||||
|
||||
bootstrap:
|
||||
enabled: true
|
||||
# The namespace that will be autocreated and the local cluster will be registered in
|
||||
namespace: fleet-local
|
||||
# The namespace where the fleet agent for the local cluster will be ran, if empty
|
||||
# this will default to cattle-fleet-system
|
||||
agentNamespace: ""
|
||||
# A repo to add at install time that will deploy to the local cluster. This allows
|
||||
# one to fully bootstrap fleet, its configuration and all its downstream clusters
|
||||
# in one shot.
|
||||
repo: ""
|
||||
secret: ""
|
||||
branch: master
|
||||
paths: ""
|
||||
|
||||
global:
|
||||
cattle:
|
||||
systemDefaultRegistry: ""
|
||||
|
||||
## Node labels for pod assignment
|
||||
## Ref: https://kubernetes.io/docs/user-guide/node-selection/
|
||||
##
|
||||
nodeSelector: {}
|
||||
## List of node taints to tolerate (requires Kubernetes >= 1.6)
|
||||
tolerations: []
|
||||
|
||||
## PriorityClassName assigned to deployment.
|
||||
priorityClassName: ""
|
||||
|
||||
gitops:
|
||||
enabled: true
|
||||
|
||||
metrics:
|
||||
enabled: true
|
||||
|
||||
debug: false
|
||||
debugLevel: 0
|
||||
propagateDebugSettingsToAgents: true
|
||||
|
||||
## Optional CPU pprof configuration. Profiles are collected continuously and saved every period
|
||||
## Any valid volume configuration can be provided, the example below uses hostPath
|
||||
# cpuPprof:
|
||||
# period: "60s"
|
||||
# volumeConfiguration:
|
||||
# hostPath:
|
||||
# path: /tmp/pprof
|
||||
# type: DirectoryOrCreate
|
||||
|
||||
migrations:
|
||||
clusterRegistrationCleanup: true
|
||||
|
||||
## Leader election configuration
|
||||
leaderElection:
|
||||
leaseDuration: 30s
|
||||
retryPeriod: 10s
|
||||
renewDeadline: 25s
|
||||
|
||||
## Fleet controller configuration
|
||||
controller:
|
||||
reconciler:
|
||||
# The number of workers that are allowed to each type of reconciler
|
||||
workers:
|
||||
gitrepo: "1"
|
||||
bundle: "1"
|
||||
bundledeployment: "1"
|
||||
|
||||
# Extra environment variables passed to the fleet pods.
|
||||
# extraEnv:
|
||||
# - name: EXPERIMENTAL_OCI_STORAGE
|
||||
# value: "true"
|
||||
|
||||
# shards:
|
||||
# - id: shard0
|
||||
# nodeSelector:
|
||||
# kubernetes.io/hostname: k3d-upstream-server-0
|
||||
# - id: shard1
|
||||
# nodeSelector:
|
||||
# kubernetes.io/hostname: k3d-upstream-server-1
|
||||
# - id: shard2
|
||||
# nodeSelector:
|
||||
# kubernetes.io/hostname: k3d-upstream-server-2
|
||||
58
index.yaml
58
index.yaml
|
|
@ -806,6 +806,28 @@ entries:
|
|||
- assets/epinio-crd/epinio-crd-102.0.1+up1.6.2.tgz
|
||||
version: 102.0.1+up1.6.2
|
||||
fleet:
|
||||
- annotations:
|
||||
catalog.cattle.io/auto-install: fleet-crd=match
|
||||
catalog.cattle.io/certified: rancher
|
||||
catalog.cattle.io/experimental: "true"
|
||||
catalog.cattle.io/hidden: "true"
|
||||
catalog.cattle.io/kube-version: '>= 1.18.0-0 < 1.31.0-0'
|
||||
catalog.cattle.io/namespace: cattle-fleet-system
|
||||
catalog.cattle.io/os: linux
|
||||
catalog.cattle.io/permits-os: linux,windows
|
||||
catalog.cattle.io/provides-gvr: clusters.fleet.cattle.io/v1alpha1
|
||||
catalog.cattle.io/rancher-version: '>= 2.9.0-0 < 2.10.0-0'
|
||||
catalog.cattle.io/release-name: fleet
|
||||
apiVersion: v2
|
||||
appVersion: 0.10.3-rc.1
|
||||
created: "2024-09-23T11:14:58.058530831Z"
|
||||
description: Fleet Manager - GitOps at Scale
|
||||
digest: 643794fbe1c8e1097c014afc9afd3ec7f3d58a6b168dd42c6d2b4a199ebe3e5a
|
||||
icon: https://charts.rancher.io/assets/logos/fleet.svg
|
||||
name: fleet
|
||||
urls:
|
||||
- assets/fleet/fleet-104.0.3+up0.10.3-rc.1.tgz
|
||||
version: 104.0.3+up0.10.3-rc.1
|
||||
- annotations:
|
||||
catalog.cattle.io/auto-install: fleet-crd=match
|
||||
catalog.cattle.io/certified: rancher
|
||||
|
|
@ -1760,6 +1782,25 @@ entries:
|
|||
- assets/fleet/fleet-0.3.000.tgz
|
||||
version: 0.3.000
|
||||
fleet-agent:
|
||||
- annotations:
|
||||
catalog.cattle.io/certified: rancher
|
||||
catalog.cattle.io/hidden: "true"
|
||||
catalog.cattle.io/kube-version: '>= 1.18.0-0 < 1.31.0-0'
|
||||
catalog.cattle.io/namespace: cattle-fleet-system
|
||||
catalog.cattle.io/os: linux
|
||||
catalog.cattle.io/permits-os: linux,windows
|
||||
catalog.cattle.io/rancher-version: '>= 2.9.0-0 < 2.10.0-0'
|
||||
catalog.cattle.io/release-name: fleet-agent
|
||||
apiVersion: v2
|
||||
appVersion: 0.10.3-rc.1
|
||||
created: "2024-09-23T11:15:00.195555839Z"
|
||||
description: Fleet Manager Agent - GitOps at Scale
|
||||
digest: c6da20b6d41ec14a09dae31b301fd3bc8cecddf9407ee1a01161cf62661adc73
|
||||
icon: https://charts.rancher.io/assets/logos/fleet.svg
|
||||
name: fleet-agent
|
||||
urls:
|
||||
- assets/fleet-agent/fleet-agent-104.0.3+up0.10.3-rc.1.tgz
|
||||
version: 104.0.3+up0.10.3-rc.1
|
||||
- annotations:
|
||||
catalog.cattle.io/certified: rancher
|
||||
catalog.cattle.io/hidden: "true"
|
||||
|
|
@ -2477,6 +2518,23 @@ entries:
|
|||
- assets/fleet-agent/fleet-agent-0.3.000.tgz
|
||||
version: 0.3.000
|
||||
fleet-crd:
|
||||
- annotations:
|
||||
catalog.cattle.io/certified: rancher
|
||||
catalog.cattle.io/hidden: "true"
|
||||
catalog.cattle.io/namespace: cattle-fleet-system
|
||||
catalog.cattle.io/os: linux
|
||||
catalog.cattle.io/permits-os: linux,windows
|
||||
catalog.cattle.io/release-name: fleet-crd
|
||||
apiVersion: v2
|
||||
appVersion: 0.10.3-rc.1
|
||||
created: "2024-09-23T11:15:02.300923914Z"
|
||||
description: Fleet Manager CustomResourceDefinitions
|
||||
digest: d8eed853275dbe3293d07a0fbbd0dd8837e41de4dc4de8b1dd561f4642f2de7f
|
||||
icon: https://charts.rancher.io/assets/logos/fleet.svg
|
||||
name: fleet-crd
|
||||
urls:
|
||||
- assets/fleet-crd/fleet-crd-104.0.3+up0.10.3-rc.1.tgz
|
||||
version: 104.0.3+up0.10.3-rc.1
|
||||
- annotations:
|
||||
catalog.cattle.io/certified: rancher
|
||||
catalog.cattle.io/hidden: "true"
|
||||
|
|
|
|||
|
|
@ -11,4 +11,4 @@
|
|||
+ catalog.cattle.io/rancher-version: '>= 2.9.0-0 < 2.10.0-0'
|
||||
catalog.cattle.io/release-name: fleet-agent
|
||||
apiVersion: v2
|
||||
appVersion: 0.10.2
|
||||
appVersion: 0.10.3-rc.1
|
||||
|
|
|
|||
|
|
@ -1,2 +1,2 @@
|
|||
url: https://github.com/rancher/fleet/releases/download/v0.10.2/fleet-agent-0.10.2.tgz
|
||||
version: 104.0.2
|
||||
url: https://github.com/rancher/fleet/releases/download/v0.10.3-rc.1/fleet-agent-0.10.3-rc.1.tgz
|
||||
version: 104.0.3
|
||||
|
|
@ -1,2 +1,2 @@
|
|||
url: https://github.com/rancher/fleet/releases/download/v0.10.2/fleet-crd-0.10.2.tgz
|
||||
version: 104.0.2
|
||||
url: https://github.com/rancher/fleet/releases/download/v0.10.3-rc.1/fleet-crd-0.10.3-rc.1.tgz
|
||||
version: 104.0.3
|
||||
|
|
@ -12,4 +12,4 @@
|
|||
+ catalog.cattle.io/rancher-version: '>= 2.9.0-0 < 2.10.0-0'
|
||||
catalog.cattle.io/release-name: fleet
|
||||
apiVersion: v2
|
||||
appVersion: 0.10.2
|
||||
appVersion: 0.10.3-rc.1
|
||||
|
|
|
|||
|
|
@ -1,2 +1,2 @@
|
|||
url: https://github.com/rancher/fleet/releases/download/v0.10.2/fleet-0.10.2.tgz
|
||||
version: 104.0.2
|
||||
url: https://github.com/rancher/fleet/releases/download/v0.10.3-rc.1/fleet-0.10.3-rc.1.tgz
|
||||
version: 104.0.3
|
||||
|
|
@ -1 +1,6 @@
|
|||
|
||||
fleet:
|
||||
- 104.0.3+up0.10.3-rc.1
|
||||
fleet-crd:
|
||||
- 104.0.3+up0.10.3-rc.1
|
||||
fleet-agent:
|
||||
- 104.0.3+up0.10.3-rc.1
|
||||
|
|
|
|||
Loading…
Reference in New Issue