From 997fa0dd5e9014f8f55db56ca153372724988d0c Mon Sep 17 00:00:00 2001 From: Muvaffak Onus Date: Tue, 30 Nov 2021 16:50:38 +0300 Subject: [PATCH 1/2] universal-crossplane: add v1.4.3001 Signed-off-by: Muvaffak Onus --- .../generated-changes/patch/Chart.yaml.patch | 8 ++++---- packages/universal-crossplane/package.yaml | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/packages/universal-crossplane/generated-changes/patch/Chart.yaml.patch b/packages/universal-crossplane/generated-changes/patch/Chart.yaml.patch index 5853cb35d..44a482d9e 100644 --- a/packages/universal-crossplane/generated-changes/patch/Chart.yaml.patch +++ b/packages/universal-crossplane/generated-changes/patch/Chart.yaml.patch @@ -2,9 +2,9 @@ +++ charts/Chart.yaml @@ -1,8 +1,13 @@ apiVersion: v1 --appVersion: 1.3.3-up.1 +-appVersion: 1.4.3-up.1 -description: 'Upbound Universal Crossplane (UXP) is Upbound''s official enterprise-grade distribution of Crossplane. It''s fully compatible with upstream Crossplane, open source, capable of connecting to Upbound Cloud for real-time dashboard visibility, and maintained by Upbound. It''s the easiest way for both individual community members and enterprises to build their production control planes. ' -+appVersion: 1.3.3001 ++appVersion: 1.4.3001 +description: 'Upbound Universal Crossplane (UXP) is Upbound''s official enterprise-grade distribution of Crossplane.' home: https://upbound.io icon: https://raw.githubusercontent.com/upbound/universal-crossplane/66ce9eb2c5a0c3af8ed7d19551a2c4d743b933b9/docs/media/logo.png @@ -20,5 +20,5 @@ - email: info@upbound.io name: Upbound Inc. name: universal-crossplane --version: 1.3.3-up.1 -+version: 1.3.3001 +-version: 1.4.3-up.1 ++version: 1.4.3001 diff --git a/packages/universal-crossplane/package.yaml b/packages/universal-crossplane/package.yaml index ad3e815ac..55ef22745 100644 --- a/packages/universal-crossplane/package.yaml +++ b/packages/universal-crossplane/package.yaml @@ -1,2 +1,2 @@ -url: https://charts.upbound.io/stable/universal-crossplane-1.3.3-up.1.tgz +url: https://charts.upbound.io/stable/universal-crossplane-1.4.3-up.1.tgz packageVersion: 01 From 5e07512a258ef247307e899656b12da1ea93d160 Mon Sep 17 00:00:00 2001 From: Muvaffak Onus Date: Tue, 30 Nov 2021 16:51:00 +0300 Subject: [PATCH 2/2] universal-crossplane: run make charts for v1.4.3001 Signed-off-by: Muvaffak Onus --- .../universal-crossplane-1.4.300101.tgz | Bin 0 -> 11617 bytes .../1.4.300101/.helmignore | 21 ++ .../1.4.300101/Chart.yaml | 40 +++ .../1.4.300101/app-readme.md | 36 +++ .../1.4.300101/questions.yaml | 184 ++++++++++++ .../1.4.300101/templates/NOTES.txt | 15 + .../1.4.300101/templates/_helpers.tpl | 21 ++ .../templates/bootstrapper/_helpers.tpl | 21 ++ .../templates/bootstrapper/clusterrole.yaml | 26 ++ .../bootstrapper/clusterrolebinding.yaml | 14 + .../templates/bootstrapper/deployment.yaml | 64 ++++ .../templates/bootstrapper/role.yaml | 28 ++ .../templates/bootstrapper/rolebinding.yaml | 14 + .../bootstrapper/secret-entitlement.yaml | 9 + .../bootstrapper/serviceaccount.yaml | 10 + .../bootstrapper/uxp-ca-tls-secret.yaml | 7 + .../bootstrapper/versions-configmap.yaml | 11 + .../1.4.300101/templates/crossplane/NOTES.txt | 8 + .../templates/crossplane/_helpers.tpl | 14 + .../templates/crossplane/clusterrole.yaml | 93 ++++++ .../crossplane/clusterrolebinding.yaml | 17 ++ .../templates/crossplane/deployment.yaml | 106 +++++++ ...-manager-allowed-provider-permissions.yaml | 16 + .../crossplane/rbac-manager-clusterrole.yaml | 94 ++++++ .../rbac-manager-clusterrolebinding.yaml | 19 ++ .../crossplane/rbac-manager-deployment.yaml | 87 ++++++ .../rbac-manager-managed-clusterroles.yaml | 279 ++++++++++++++++++ .../rbac-manager-serviceaccount.yaml | 11 + .../templates/crossplane/serviceaccount.yaml | 15 + .../upbound-agent/_deployment-spec.tpl | 87 ++++++ .../templates/upbound-agent/_helpers.tpl | 22 ++ .../templates/upbound-agent/clusterrole.yaml | 40 +++ .../clusterrolebindings-managed.yaml | 34 +++ .../upbound-agent/clusterrolebindings.yaml | 31 ++ .../upbound-agent/clusterroles-managed.yaml | 66 +++++ .../control-plane-token-secret.yaml | 11 + .../templates/upbound-agent/role.yaml | 66 +++++ .../templates/upbound-agent/service.yaml | 16 + .../upbound-agent/serviceaccount.yaml | 8 + .../templates/upbound-agent/tls-secret.yaml | 9 + .../1.4.300101/templates/xgql/_helpers.tpl | 22 ++ .../1.4.300101/templates/xgql/deployment.yaml | 63 ++++ .../1.4.300101/templates/xgql/service.yaml | 14 + .../templates/xgql/serviceaccount.yaml | 6 + .../1.4.300101/templates/xgql/tls-secret.yaml | 7 + .../1.4.300101/values.yaml | 185 ++++++++++++ .../1.4.300101/values.yaml.tmpl | 185 ++++++++++++ index.yaml | 44 +++ 48 files changed, 2196 insertions(+) create mode 100644 assets/universal-crossplane/universal-crossplane-1.4.300101.tgz create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/.helmignore create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/Chart.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/app-readme.md create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/questions.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/NOTES.txt create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/_helpers.tpl create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/_helpers.tpl create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/clusterrole.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/clusterrolebinding.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/deployment.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/role.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/rolebinding.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/secret-entitlement.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/serviceaccount.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/uxp-ca-tls-secret.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/versions-configmap.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/NOTES.txt create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/_helpers.tpl create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/clusterrole.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/clusterrolebinding.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/deployment.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/rbac-manager-allowed-provider-permissions.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/rbac-manager-clusterrole.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/rbac-manager-clusterrolebinding.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/rbac-manager-deployment.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/rbac-manager-managed-clusterroles.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/rbac-manager-serviceaccount.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/serviceaccount.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/_deployment-spec.tpl create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/_helpers.tpl create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/clusterrole.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/clusterrolebindings-managed.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/clusterrolebindings.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/clusterroles-managed.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/control-plane-token-secret.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/role.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/service.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/serviceaccount.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/tls-secret.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/xgql/_helpers.tpl create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/xgql/deployment.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/xgql/service.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/xgql/serviceaccount.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/templates/xgql/tls-secret.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/values.yaml create mode 100644 charts/universal-crossplane/universal-crossplane/1.4.300101/values.yaml.tmpl diff --git a/assets/universal-crossplane/universal-crossplane-1.4.300101.tgz b/assets/universal-crossplane/universal-crossplane-1.4.300101.tgz new file mode 100644 index 0000000000000000000000000000000000000000..5a6d5038bd12375ebe14aa8dd70e602a1898bce7 GIT binary patch literal 11617 zcmZ9SWmla|6J`k(+&#E^Ah-l~cXtSoV8NY(yF+jd?(XgccY?dSbC7dSo_EcBnf?jg ztE%hTwaKCoaG?G>00R`0sf-$%xr`#Wf+ruB8HW~|g*w-FJ#{{AWi2gkMQz(3ruG(| z8mbOoWxmG*g5)3=wK6O|sd{Hayj%DN2dXvS76-41&Z4 zXtwJK5v;xE)11B2^2;snYVSbr;0iDl+cTw%-0ywnBXs>iAJ-=Z_i1T&Wvm3730@?F zIMt~=C`pf3>&Ud@DHVdZ10l7V<+F>ci!#8w%LoiWHX&2SFW&E>AP1|S7U5_48sWbr z#BXq3PjlY#a;+lgpSuK}G^H*%Wa%SIMFMBS(Mh1t5piZ@m&L_kTjh_N!_vvk1K%kI z!y^zHR?UPGoUIO}=m*6;KE+vMfv>r<4Syz2R!@RKUDbl;_021%p54NI1Dj#^ z^EY@ic(py;#M7t4Vv&tRu(uooB+NrwO(N*9LP_v>Etdxe)*U|#If@8!kr3niP|qMZ z>JE!W~v|La};E2XoaYAB|v6cNqd(MVuV}9_EQ*nwh;Jk@%xAyv^54q3J zX}O1wgj0a1GdtACsx5SVhO#Rxf*S&W)7PuKtqb&SCou`i0GZ%)F}$#FSaC#}_vxi@ zD4e6CiqSKE=fibZ&(MdLDRbxZ_u^GP_n1J~J8yL;mRk@AG{ZCwyk|qCAT?Bf{(!t< z2&sff#prTjNk&X{WMPDYyZ4@X(Tp^+S+e6hiM5(^{vyuCSj zwg_axe1Y(3gxNHpf}1o6iHQYty57-|bDb3JN+z8^l0n+`N^A}o+Q7t331+2}!EF8$xrU-_V2Ooi0PhX4zaGkmFT@`hsbT1`QS)S)(=f-v z(@5aL?|9^>-4=+qIZa6q+lG@y;i#!IV4;k%Q1Z9VLQb{A#knqnAX7HK<6q)UgnG`W zOaLxN;@B>U0CLy8D*DIK#N+s$gEUlA5Zm7kS>gAjS?Z~teDXXVt7wBHDCKMRCzZSr z>|y%tjImMSn7|djqFplTUY}t&G*ny?jzej+tv~ifVv1st$WTgtBXn4I6eu`OH%;1< z^WdlfDjTfIAf+PKWrPcw`B~`ISKI{tyG&9sNFx?c)qKqCaIQ%i);1 z89{lybx>FVX=bBCF#CzcXSRJe(_uB!O0n528-E=)my~5rUs#~F>7!xRyZRd_=r(COoHmUqWGj@(mYEHINVj;z|C`N z`dDs1NDqU0yB&Z;W3gMX+xbxIc?c<+833t5PL(Qb-1;pCO4!4-+tm1#BNGs{JI zP@Q2S{=ShvRPlX?>%lN2y(01ex6z|5+Xum7K0UN*xvoB~y8PazX6*`%Q$%r0v)PKm2JH@2ZubB>GMOUuI;&1+%v^|4mZ1b+-C$`HybFmZC zs}VVti;8a9Rq%bEGI<5mNj3 zTqxKOr$vwl#1bJ~Qru-A3^rt7XA33n~>n@`$%azHaC0|6!_ zXicx6fB{|+=(`J^lGG7=Lr12|Iq5a<)wW4ZBOn|P*gXO^GM_CmI8IH^ldNxvEjd37 zvXM^@)RE6hI5kNR@TT>lVya`Lg%GRk%O~t&H{~WX=d$KQ@9u<~+gBxgIT$+8Stk!Q zR4*04HQnX~odkjN)DI znh0E~5xY+W^{ZnIdR%k*N|dL7*Dc@<)ccw91G*%}Y^IANeV^s_2}xI>wpY6c&deZy zKEl_ni6t|~F5z?nz9|Uy`%X`dVJw1mCcfaZQN{x=gRrl-b9G2{T%(raiw^1qIVTb% zuJOXGES@Q(Ry>sQyM@J(9Sx}K_4b!2Z74Oz4;93|* z*3uJTgN3%ZYNr6rY{?E`O}4lx_CVOO1-LGS2>4&T zKdvk1W-*}kv*y}+s}ByUIKfABlHahqER>+RaDCq2YU8UBWS?|Vx1=yXKK*nua6YAc zn9qA@L_;+}$;_4-N!wAKkfl?0`_V_Hv{#a}^1CEi&GV%-H*@WMNH-nR;&P!Zy8fpK z_2H?i3%#1JcIBg=L-7`O<&>pJNwp-D5l0Vi9Ckq7xIOi3)_cJF`vxU&b&lfIg$mSA zu}lD9jpn1^ilY*nVtqQp)0J+ zglSz3H@AIA)#&1#Y2`16ie9gpy&e=Glcst-lhu`Hy%|_LNd<%4pG+D6efj#TAAb=% z4U@wezU{la5-xPTXfZ8yJ4;f65SF@%u+0MgeT8fs70=I@b7ksGv6;(A)ju$bT;6Ts_ z8q1UZ%@{#FqJ<43$#D%$8SzfhXA2)J9`3{3a^ODD6P^~_m;_NlaDiBaa^=eEsY2pp z_LHpZ(}=7Mfs0?~!tRe~ZalXjmhY}$KukG6S{;V7_sGNc(lN$SoC+RIL^FT|?z6HK z&~NnPvEUPjK)?8OK}1`Mek61}@}E;Y)~{c^{@xge0#*81MG7$b&maeP_nuD3+RDnt zHNc-Z3DC!SPMv;knDt}EJ7Rwf#qDTyAuG~HJy_itJS|?B?Ig+A*y)Dnl^o-=-(gW# zIkpjHh-;!KQ?dcXacxv#048V)|3v7Bf-t3+0c~VDq*@x@b0k zA%SW_HJ`7m{QT7;0RN+g8UL@PV{eBR6+VF#zPQjsD{N_$*u6kZ@{U0F?wZ_G_(iZe zw`_P^3nG#s!+M)Q@dQ_}V?r^CJKSS2=8eksoK1R|!#$VU>KQMW%h}Z>sm?z8>zkg} zFGYd7Kv${U?=UEm*eJ%Mrd_^h#>Y{x1b!_d4faz~-@Bk~X-uMezGmpRm*|wBYN32& z<_w*wW92fLGRmOuOP>#NK`u~Vu^~4 z&0{L6$Wf$EYWys>E>Ga$_zcrlE=)JPW7Pt2giMX~um$ zi77+H55`6nF3g`nLM={OILyfRVfL+`4(*a(m=&J+Ma~J!V)Wb74droTW6#RhrzkfF zx}|K*IGhdRoW`^Tk`!2&w27+kLkrGKeUG#~9*MhEENSgT2-eaWiQB^4`Z=D(%T)iU zWZQq_zY;h=N_UN_%=d1#S71!T>He0;$|argSq$ZWod1GYn26eMb@vSqC`IamLl z4SpicES{9(DDgF=uHr80KfY*;7Gherw3Td7I<=yRNq2OTm?5Ua}7#WY{zGYsl z_5I@lX^-U_0x4+s9C12TR{7f+9TFj-u-G^l=GyXlk&jZEDc-HJ`syFE+-+eQDdhwJQ20j)oHpiy7bqavIYs zkx*;1tD>^;GpL)9phw>@cRuu*tG@-61sNylO@rJY8J|EMnRmHOg}D2`k>_;>-%XX` z_;nBauSSWx_jTa>k?Bde{y7v_j!)5=FJdER&@XjPDwinLK61x~GQ-=W$QnKt56n&D zx;RQr*#ptMO{kvl%KLLe$WYM6-nQ1Z20=RVKTM7SQ}lIbKkWokf>b}ut1-Lh%#kGj z#{aNgaUb|$5cu@Jn_cwu>YeF_wbOg8tJ^H(WElX4y8=624k;vV-YWr{djMi$4m71`j04g? ze2fcPm0%YX2skJ%JL{Fb$Mhk8ZjZrwY*;z$g0w9&ZI?JTD;>~^Ip5)Y1;7~0YRV}U z8d_obQ43mdOp8ft&n4y9YL|`oe+LX@S>7Cc4K{E)T>;}d;QZ>`_7b#|H~~(|stRc+ zRn8@rRy2}{NtiI;PUpWWB5~kgGV`63(=$-Dh^!nmCH1Z^cDWp(qj+T}+%coTDZoSw zCr@(+O^8d_U;69M?Y{N2GyVJoTs^^m19~8|kUg(CGYDvm@A8>jYD`(ed$DASYAm-! z{~?CS3;x9;I#I-*M)Hg1kCD7!VUb$uTN9A>yKH}yMWsv4+P<_$A?qC{G0_*qV%;^Fn+wP({3=*hYN2?51u`_ac9;lhmu!S73+mwtFD7S?ak_`3BifWcCNzG4}k z%+DgQ4vQ$8E};JT(dk@G*~Ix(+uX9c^w(V&wfZWx8(h=#cLb6?taWxg=IcxC5m!Si zl0veKylm9?uagO?UvUw}zY@uRS24ATVUVc%KwyhsPwAb@Y6O`XnCZZ%D0R%I12coiw(rR#Lz57<+4^(8FHC{f!W%3B#^0B7VLl z$B)$``Ae<@O;pJ3piJBv=XIpcTK)e>&^K-146EN zH7}U@#pEZ_8+sMaj!be@PCtjxR&ep*jkV zzb$;D2VD@>iX)1}G-CCS);3$Zl*BPF*>R4%YXa|d&{S56ygt0Jve86VFQO_85oxQ3tcwE@b?iWXAhpa zAoxH~k`+>j^#Lw^l8F$%O58n84-FU+NhF)~dRzEGO#S;nJRqxo;Wpvf;)R;)AP5JW!?(Cc#$v|CO#_rl`_8aDO%ReU9=Gn zn>{A7bsXHA))!m4`pIe>U8Qnqjz>=58qr{_Oivz!$i>b0GT&L}Ywhj+FzQ*#bn{H# z6?gw-bivQ$njw^F#ZrD3cF(x+tw{gHtMYwo_Z7q~mSdAc>b!X7_;)(RxEj~B-brxA z529TUY+hVAya_KS$tA6M4a}WO99S5x*&TF#f8dpyC1t)Gw$9!u2XcWnB#uTG3E*zqo0HnY{*jttsQcNBs44vLSxcm_)BSv|ahW2A|w zvnaGEl44!2L!Nl#Uw=avAFl=rjl3jmXArjY+v7=5VS%3(8{6`Y{<<78=$h?++T|Jr zI?ez$bAP<|tt-t-;PHv)3aFy{S_?5=mDzUIffsBY5=lTn&O}d^X$ha~C2>Q`ytk5J z8Uu==MfLW9ZId2iz-C7HZx&EV!@>ew*;Ch-hksu7COV|T>${vyE{r@IuHNrEmpcvb z(xSp{BjiZ3-q510AWUDtsNAgI&#ykEfoi^qv^)Jd{d6iR5Lxtj`D~=wmHyC2_#sMY95JjsDLjEl8WrXSGI< z)Iv`9+!iunCy6Io*QaA4>y7H&zL9wmiVAs&;W@m1{vib&!&2$u?$FX4c_X6!E&$Vz zr7CJS$xUz?hpW8~6ggO|m9)hO^nqV{vN!!`AoHRi_dTE?r7`psIGBb?AWO6+IkIi1 zdiA$U&(Y}9$_&LQbFW*nlrW9=N|Y`^w`ZYHoo)`bDd2sS<*U5uLF}VBJS%zP>f-@& z?o-lgayO}@9Gas zY=1WQ)~jmwV!1+O3AN#o%P4~K$aRO)_FS^tmp#s<&0X4zv)`)H5b>rLzd@XR)q%71 z?tx%r=e=CQiqWl8SudPIcD|en3{8p*KK;`TFGRY5(T`*PkqnkR!RF)%y(pg0_Tgz` zUw>M-g%$r|HBh=y&~?c3S6@tQpjrEZp^`#6VK#13nvF!5>`9YJo$bJXSEj-PZ5G)? z80BYeR2Uz}mZ$2^wZ4iVsiFuggKzmQ{1do1I=t(vXLX0MudTcep-u^yCnAwCnR459 zg9)ijHENjpz3FWs)qCPny?L!glN+PZCHS0GD2r-h8+neVi zPNfF*tKU(&w+kdu{#J!HT~|d#S+;-r=rdD+o|TRk;S6mgfWDw>``}*+m?}3UBu+Gu<>)ZM1&WTZ?)@9`v;v_;MD|^U>Gl$kR-H0Hj5IfadMn|pI;RhA-s?kc8n4G>?kyeZTEmSf*Rf|rdJmE%3mwQ)sg zJUYQu!zEEK)lQv;he2r4abRHv6A2+2kBF^Lm0}h8v5x4(4vorc)J_p%JeyE@9AYMH zv3C5f>2=Y(ovY>s&GdL2SYZ_X#D;yD2J05QVaMEQm#&J(Nx5wpr}?R^zoBTgwZB2^ zQ%e$hz!`;mvV@;MzWtaut~DifYZR4maiM?Zo6!1Zvy4^7X$D6i89hGDZi-x%D(!aM z`Ox6h=B9ngxoJuteiA?Z4Z@9C9p;1O7ID$kK*z{4?Q6s-x`P_w`*XS3_C+=gA?2NJhI*ldQGURJrJ;Cb$^XgPfR6 zp6r$qo|W1S!{M-q1F7nv;AD6R#;p;IQ_K~n=E{0`+M{a41;`a|vRJ+vZf2kh7u$6CPT>8yS5fW%)RI?;mF90Coq5GW~(?-dQm5qE4hGp5B z{E88S6-)SeFDEDBtd9jG0okB#F zxRhbzf1*eb1~YV6qHtpRJ0#Errq|IcE5|n4F(E4cfGDIqkhF zOb<;Kry-q-N-g>(;fI&ORoX33G@lphxN57BB2#e+EDW;7z;ZZzo%s#CeyOnl*#E8# zf^_A*aNc_^J-%?I*o|Aag~f>%KurwH{LQfR(>_q){4U*0-kn5j^rW&#FeX%$uLdPF zs8SYcQw1SS1g;nX{FRT*b9q$dh>AoXFODbA`3MPWps)x`)u za>>CGptssqo?Kz8XlTdD?T$ZV2{g2{s0#sGD;w)T4b89U-b}@~qvwDzM3tJ-loo4y zKAh6ouP;Rv^8~&!wMk-mt40{G&oKX^PPR4&bi>8yDJi?aH&l?qj~!s+eZy}BQq$6K z0~pAAHNN(+JlF6dx0(h*S=I5JS{79_*+Jl)+lj_f45#qcOPxbngmXXa02w%O0Mgbjlb(X)!2`=Czwy;8g28v z{QScxR~$*Rlt!x5?1gL+(7iOfNLNgtF&8fimL~SxhhF-s56E(oP)==(-B_C-98(M9 ztRL1ML5r_I3^39@SFi=72E|rh{SZdQQt>JEZ1aa1?wY?9b*+evfUZNt!|j>p&sC4P z)(H1dM02mW2I?vN|FNW(U(aM+L6Z;%mXkj>K%i*Yr83G}N7ns9Nzt=0tWUz-rqhoD zz-S1l=xNyjnhHw>0o0>WP3`+%o?Sn+-mWH}X`8Nri+%Ch@-_FA)n^bJ{T=AaWDjV| zX$%BfkbY}80V!L0UESaEX-lqhtKhY6z*=^nw{H#6#T~Pa(Z_Gmws6x(y=!geDBp6W z-}QHHtpZ+i`|^l^mL8tJ$3PRcK5hZ;Ay{;C+;(AYX*Weg$Cja*(6$fNb278a`SEzM z_=!u#t+&rgm|QfFdbFb-br2?>vvGIj7-F3ehRrxf zS9jgAhP)(>B+G#BsHPaE<<#f`@-oc$qja^dGi{yhwGz zFNezbb5C&vK&7I=wf2a}f z^u=MwCYQM>2RQ%r4)XdJ4Rap~I}C;d&)Xf!XmswrD!g+=S4FH{{zF;eq?{~$08{5% zp87vxbwB>r)6mcc=qk5|RiwRQ!Ne&>g2o#WfEtgBq#|y}mG&m+&S7BkaU37_`jurVQ2!`uKn>= zS6uUJ?k2=99Y9Cpz5$jJo42dDYf9bE-(N1Kt)_`fx==9Ct`zEOo@Cq_!UiV!J(cWdM&Wf=*CGn*m zrSH|tu=pTx>y|ShK(vQ&zvH`k8XW%p%c&Qqg6T%}UWC_h&T zbZN+~q8y8d;gJmSqjbxI$|~e1n6#Lf90-oQ{m~U#&h=KYE8VuSY~h3t*zf*zbz2`o zxUcx9Qj(LoyWw0&j_@<+!w`waUu5FK7|}U0YF}gvd{(K@wO7yhfjm)>hk_%6?X&@e ziY=D_%NVOp=1SxhMR`tM)St_aFNPjPU8i@HbT!0BHCXANuwc^x+3;$%>tNHBJkM&M z$P2v`5CkEvjDg{g%x_rtokbmA71VNTo|G2C8H8dYzInN}hog2bobS`T>914%tYHJ8 zdo&LkwML6hcbw~wWg{(J{(@)xQ^ugz3!bAIqkib0V8ngba7`Epl+dDNb~bC)OoUT+ z*#zu{4pz`97BoKvW~==~sYdk{JC3LNM6c_l>YTfA=T~pXm&eKRr!Z;h5{E5=3?Ycu zSkCw%%!X<|O)>pgySKZ?qg==HRNvfv-DF)ncB(@K(%Z^4={BskcMs@kXlI4#4n7&) zw*^^x%mx9&VB6#zBGQIrY|$#0KBP&`CRlRBh6U}Z{`~uSW+8K6c|?;yvBrC2AxTyd z<6=ocS}K@8x-4zSrYStZ04{vMVNz(eM-&U3*5?p{2|;c3J9w*WTB6<1E;j^xW!SV; zKWla0G8BT(dLWm5et&?Do}P}ne|0_<>UC`UtMOZ(o z@nbDgrfiZqk;%Tf8?m)(C7LN}8W$g2p}@$P$Y?T*EmF$JRg+&!?s&jL3gcYgI!%mLhO*j38!}{$Hf(;7qet>@1mh%jf{HS$ zADgSsME1>Ka8`NI)7oF@{$RNV9eqa^MNBZRP1vncgcc!qRTh^+j1aS-0Ll?U>zlKn zQZCdWQ_7(ZFQ_X+a+VtA#|Ql<#+$Qk;5Zd!**5sJUM>mDUF-w7&XB4fQOdBq`#rNP zvm^#`9y~|zEY{Fg){@^|I>2>Ygl`L(;=iMgOV>h{SyjtaWLqwccv)w3kaB(q-JgL* zotJgPe^3=GH%evZbt?OtI;40qt=XV)I4#I!9_P?7_MM@r_N9(OU+sq3-wNA^zdT&y z(<)mlV#BHv+`2}bDSybFt3G}=KT2RtG|EAIOX1A$sb|S9v~)Ee%tSJ$Jg;S*m_who z-2FoHeNAvwJ#`C_8heMPGo!x+>F!4`MMTb;@&1?wnYbRAX6Y0P)*Z1%L8OMsQiT-L zc*v9~26H|tKB@YD#ERLikpyV_?xOz#=ji%7^MZ|@i!C0>sZY6(*2CAS9gVxJ6XZ6& zTgDj86~(JdVw(h&Nk$WQvDSWO)R?3VU?nX1H2LetM bq;CGl2&loG)PZF><8S@G z!ELd{jEEr)<`W39g6pn~72)N0N`K614<+9<@47_Zcb0Y5!r z#K$xgN)g0dOY6%1u)nC9#U)hXM6b}!>YL9~MnQD0M?fvD_!u5|wG^c9N zli1F#q(+Z#b`v!lEERu#lCAB!l-?7oi{c-mCLrZ53yu@r;ip@k+?2$=)lT>@Eh^M` zik58$=JV!sa1iSb9d0ja*<#|@g{Sn_s?@najJ*NpD#LzDdX#ob1D4~UUwY@DM|7{Q z+xO{hlRL@MjFuCv+heR5qw9=NC(QFL&5ANd)75ZO(}{b9t}}A<6hEA zhMa``sm7$)xkd)ZXBXoGAU|*s42C{yXU(ufDX)3jo(!*&gm2ccGeQ4|a%|oQ?pg4n z1E&@`;Xn7T!~?^$u-eH;bLE6vCNQ)5F6_Te7{j#}SI5-VDqOCYcA8>R!k$jYSpKe@ zY>UDv&lN`%Oh?u^)PZ?eeu}bMS!7# zuf_7G$N%fk4fhFY3@o*9a)@;u@j! zUZFNV(^ZwuV&R2=uOC+a)HM`+5|~C!`GF+q4-=d?{#_9)n0ugJ@-S^~<>W#lcMoHd*{2Ke9}NC72Es_Y zJ)S=|!@Jub#}44v-pW({FvD>^9ZL6#v!Q=UPi0_bKDy@Y)ScX8^n_zE+W%tAoz1Z7 zrJ30__=$@t^&~woyTA!=HD++{63#6&-<2=Tf?bo#gMxi{~ov&)1-}pItd3ic|`gypy`9RuGI%39i z-S4F(E~1mY+IDI%JNm`o= 1.15' +maintainers: +- email: info@upbound.io + name: Upbound Inc. +name: universal-crossplane +version: 1.4.300101 diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/app-readme.md b/charts/universal-crossplane/universal-crossplane/1.4.300101/app-readme.md new file mode 100644 index 000000000..c6d8ecfe0 --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/app-readme.md @@ -0,0 +1,36 @@ +# Upbound Universal Crossplane (UXP) + +Upbound Universal Crossplane (UXP) is [Upbound's](https://upbound.io) official enterprise-grade distribution of [Crossplane](https://crossplane.io). It's fully compatible with upstream Crossplane, [open source](https://github.com/upbound/universal-crossplane), capable of connecting to [Upbound Cloud](https://cloud.upbound.io) for real-time dashboard visibility, and maintained by Upbound. It's the easiest way for both individual community members and enterprises to build their production control planes. + +## Connecting to Upbound Cloud + +You can optionally connect your Universal Crossplane instance to Upbound Cloud. +Follow the steps below to connect your Universal Crossplane cluster to your Upbound Cloud Console. + +1. Install Upbound CLI + + You will need to make sure you have the Upbound CLI installed before you continue. If you need more information on how to install the Upbound CLI, you can read the [Installing Upbound CLI Documentation](https://cloud.upbound.io/docs/cli). + + ``` + curl -sL https://cli.upbound.io | sh + ``` + +2. Log in to Upbound Cloud + + ``` + up cloud login --profile=rancher --account=$UPBOUND_ACCOUNT + ``` + + Or, to log in using an Upbound [API token](https://cloud.upbound.io/account/settings/tokens): + + ``` + up cloud login --profile=rancher --account=$UPBOUND_ACCOUNT --token=$API_TOKEN + ``` + +3. Create a Self-Hosted Control Plane + + ``` + up cloud controlplane attach $CONTROL_PLANE_NAME --profile=rancher + ``` + +4. Provide the token obtained in the previous step as `upbound.controlPlane.token` under `Upbound Cloud` section \ No newline at end of file diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/questions.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/questions.yaml new file mode 100644 index 000000000..c5cb628bf --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/questions.yaml @@ -0,0 +1,184 @@ +questions: +# Upbound Cloud configuration +- variable: upbound.controlPlane.token + label: upbound.controlPlane.token + required: false + type: password + description: Token used to connect Upbound Cloud + group: "Upbound Cloud" +- variable: upbound.controlPlane.permission + label: upbound.controlPlane.permission + required: false + type: enum + default: "edit" + options: + - "edit" + - "view" + description: Cluster permissions for Upbound Cloud + group: "Upbound Cloud" +# Basic Crossplane configuration +- variable: replicas + label: replicas + description: Number of replicas to run for Crossplane pods + type: int + default: 1 + required: true + group: "Crossplane" +# Advanced Crossplane configuration +- variable: advancedCrossplaneConfiguration + description: View advanced configuration settings + label: View advanced configuration + type: boolean + default: false + show_subquestion_if: true + group: "Crossplane" + subquestions: + - variable: leaderElection + label: leaderElection + description: "Enable leader election for Crossplane Managers pod" + type: boolean + default: true + required: false + group: "Crossplane" + - variable: deploymentStrategy + label: deploymentStrategy + description: "The deployment strategy for the Crossplane and RBAC Manager (if enabled) pods" + type: enum + default: "RollingUpdate" + options: + - "RollingUpdate" + - "Recreate" + required: true + group: "Crossplane" + - variable: priorityClassName + label: priorityClassName + description: "Priority class name for Crossplane and RBAC Manager (if enabled) pods" + type: string + required: false + group: "Crossplane" + - variable: metrics.enabled + label: metrics.enabled + description: "Expose Crossplane and RBAC Manager metrics endpoint" + type: boolean + required: false + group: "Crossplane" +# Basic Crossplane RBAC Manager configuration +- variable: rbacManager.deploy + label: rbacManager.deploy + description: "Deploy RBAC Manager" + type: boolean + default: true + required: true + group: "Crossplane RBAC Manager" +- variable: rbacManager.replicas + label: rbacManager.replicas + description: "The number of replicas to run for the RBAC Manager pods" + type: int + default: 1 + required: true + group: "Crossplane RBAC Manager" +# Advanced Crossplane RBAC Manager configuration +- variable: advancedRBACManagerConfiguration + description: View advanced configuration settings + label: View advanced configuration + type: boolean + default: false + show_subquestion_if: true + group: "Crossplane RBAC Manager" + subquestions: + - variable: rbacManager.leaderElection + label: rbacManager.leaderElection + description: "Enable leader election for RBAC Managers pod" + type: boolean + default: true + group: "Crossplane RBAC Manager" + - variable: rbacManager.managementPolicy + label: rbacManager.managementPolicy + description: RBAC manager permissions. 'All' enables management for every Crossplane controller and user role. 'Basic' enables management just for Crossplane controller roles and the crossplane-admin, crossplane-edit, and crossplane-view user roles. + type: enum + default: "Basic" + options: + - "Basic" + - "All" + required: true + group: "Crossplane RBAC Manager" + - variable: rbacManager.skipAggregatedClusterRoles + label: rbacManager.skipAggregatedClusterRoles + description: "Opt out of deploying aggregated ClusterRoles" + type: boolean + default: true + group: "Crossplane RBAC Manager" +# Basic Package configuration +- variable: provider.packages + label: provider.packages + description: List of Provider packages to install with Crossplane. Select 'Edit as YAML' for the best editing experience. + type: string + required: false + group: "Packages" +- variable: configuration.packages + label: configuration.packages + description: List of Configuration packages to install with Crossplane. Select 'Edit as YAML' for the best editing experience. + type: string + required: false + group: "Packages" +# Advanced Package configuration +- variable: advancedPackageConfiguration + description: View advanced configuration settings + label: View advanced configuration + type: boolean + default: false + show_subquestion_if: true + group: "Packages" + subquestions: + - variable: packageCache.sizeLimit + label: packageCache.sizeLimit + description: "Size limit for package cache. If medium is Memory then maximum usage would be the minimum of this value the sum of all memory limits on containers in the Crossplane pod" + type: string + default: "5Mi" + group: "Packages" + - variable: packageCache.medium + label: packageCache.medium + description: "Storage medium for package cache. Memory means volume will be backed by tmpfs, which can be useful for development" + type: string + group: "Packages" + - variable: packageCache.pvc + label: packageCache.pvc + description: "Name of the PersistentVolumeClaim to be used as the package cache. Providing a value will cause the default emptyDir volume to not be mounted" + type: string + group: "Packages" +# Basic XGQL configuration +- variable: xgql.config.debugMode + label: xgql.config.debugMode + description: "Enable debug mode for XGQL" + type: boolean + default: false + group: "XGQL" +# Advanced Crossplane configuration +- variable: advancedXGQLConfiguration + description: View advanced configuration settings + label: View advanced configuration + type: boolean + default: false + show_subquestion_if: true + group: "XGQL" + subquestions: + - variable: xgql.metrics.enabled + label: xgql.metrics.enabled + description: "Expose XGQL metrics endpoint" + type: boolean + required: false + group: "XGQL" +# Basic Agent configuration +- variable: agent.config.debugMode + label: agent.config.debugMode + description: "Enable debug mode for Upbound Agent" + type: boolean + default: false + group: "Upbound Agent" +# Basic Bootstrapper configuration +- variable: bootstrapper.config.debugMode + label: bootstrapper.config.debugMode + description: "Enable debug mode for Bootstrapper" + type: boolean + default: false + group: "Bootstrapper" \ No newline at end of file diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/NOTES.txt b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/NOTES.txt new file mode 100644 index 000000000..33260c04f --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/NOTES.txt @@ -0,0 +1,15 @@ +By proceeding, you are accepting to comply with terms and conditions in https://licenses.upbound.io/upbound-software-license.html + +✨ Thank you for installing Universal Crossplane! +{{- if or (eq .Values.upbound.controlPlane.permission "view") (eq .Values.upbound.controlPlane.permission "edit") }} +🚀 You can now connect your cluster to Upbound Cloud! + +Example command: +{{ if eq .Values.upbound.controlPlane.permission "edit" }} +$ up cloud controlplane attach | \ +up uxp connect --token-secret-name {{ .Values.upbound.controlPlane.tokenSecretName }} --namespace {{ .Release.Namespace }} - +{{- else if eq .Values.upbound.controlPlane.permission "view" }} +$ up cloud controlplane attach --view-only | \ +up uxp connect --token-secret-name {{ .Values.upbound.controlPlane.tokenSecretName }} --namespace {{ .Release.Namespace }} - +{{- end }} +{{- end }} \ No newline at end of file diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/_helpers.tpl b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/_helpers.tpl new file mode 100644 index 000000000..7ba5d8058 --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/_helpers.tpl @@ -0,0 +1,21 @@ +{{/* vim: set filetype=mustache: */}} + +{{/* +Common labels +*/}} +{{- define "labels" -}} +helm.sh/chart: {{ include "chart" . }} +{{ include "selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "selectorLabels" -}} +app.kubernetes.io/name: {{ include "name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/_helpers.tpl b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/_helpers.tpl new file mode 100644 index 000000000..bdca1ae09 --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/_helpers.tpl @@ -0,0 +1,21 @@ +{{/* vim: set filetype=mustache: */}} + +{{- define "bootstrapper-name" -}} +{{- "upbound-bootstrapper" -}} +{{- end -}} + +{{/* +Labels - bootstrapper +*/}} +{{- define "labelsBootstrapper" -}} +{{ include "labels" . }} +app.kubernetes.io/component: bootstrapper +{{- end }} + +{{/* +Selector labels - bootstrapper +*/}} +{{- define "selectorLabelsBootstrapper" -}} +{{ include "selectorLabels" . }} +app.kubernetes.io/component: bootstrapper +{{- end }} \ No newline at end of file diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/clusterrole.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/clusterrole.yaml new file mode 100644 index 000000000..162abdd7a --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/clusterrole.yaml @@ -0,0 +1,26 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "bootstrapper-name" . }} + labels: + {{- include "labelsBootstrapper" . | nindent 4 }} +rules: + # Bootstrapper needs to identify the cluster uniquely and it does that by using + # UID of kube-system namespace. + - apiGroups: + - "" + resources: + - namespaces + resourceNames: + - "kube-system" + verbs: + - "get" + # Controller-runtime requires watch and list permissions to build its resource + # cache of the kind that any client query is made for. + - apiGroups: + - "" + resources: + - namespaces + verbs: + - "list" + - "watch" diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/clusterrolebinding.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/clusterrolebinding.yaml new file mode 100644 index 000000000..33fd634cd --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/clusterrolebinding.yaml @@ -0,0 +1,14 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "bootstrapper-name" . }} + labels: + {{- include "labelsBootstrapper" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "bootstrapper-name" . }} +subjects: + - kind: ServiceAccount + name: {{ template "bootstrapper-name" . }} + namespace: {{ .Release.Namespace }} \ No newline at end of file diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/deployment.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/deployment.yaml new file mode 100644 index 000000000..0030f4139 --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/deployment.yaml @@ -0,0 +1,64 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ template "bootstrapper-name" . }} + labels: + {{- include "labelsBootstrapper" . | nindent 4 }} +spec: + replicas: 1 + selector: + matchLabels: + {{- include "selectorLabelsBootstrapper" . | nindent 6 }} + template: + metadata: + labels: + {{- include "selectorLabelsBootstrapper" . | nindent 8 }} + spec: + serviceAccountName: {{ template "bootstrapper-name" . }} + {{- if .Values.billing.awsMarketplace.enabled }} + securityContext: + # Providing this is not required for 1.19 or later clusters. + # See https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-technical-overview.html + fsGroup: 1337 + {{- end }} + {{- if .Values.imagePullSecrets }} + imagePullSecrets: + {{- range $index, $secret := .Values.imagePullSecrets }} + - name: {{ $secret }} + {{- end }} + {{ end }} + containers: + - name: bootstrapper + image: "{{ .Values.bootstrapper.image.repository }}:{{ .Values.bootstrapper.image.tag }}" + args: + - start + - --namespace + - {{ .Release.Namespace }} + - --upbound-api-url + - {{ .Values.upbound.apiURL }} + - --upbound-token-secret + - {{ .Values.upbound.controlPlane.tokenSecretName }} + - --agent-manifest + - {{ include "agent-spec" . | b64enc }} + - --controller + - upbound-agent + - --controller + - tls-secrets + {{- if .Values.billing.awsMarketplace.enabled }} + - --controller + - aws-marketplace + {{- end }} + {{- if .Values.bootstrapper.config.debugMode }} + - "--debug" + {{- end }} + {{- range $arg := .Values.bootstrapper.config.args }} + - {{ $arg }} + {{- end }} + env: + {{- range $key, $value := .Values.bootstrapper.config.envVars }} + - name: {{ $key | replace "." "_" }} + value: {{ $value | quote }} + {{- end}} + imagePullPolicy: {{ .Values.bootstrapper.image.pullPolicy }} + resources: + {{- toYaml .Values.bootstrapper.resources | nindent 12 }} diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/role.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/role.yaml new file mode 100644 index 000000000..cb19df19f --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/role.yaml @@ -0,0 +1,28 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ template "bootstrapper-name" . }} + labels: + {{- include "labelsBootstrapper" . | nindent 4 }} +rules: + - apiGroups: [""] + resources: ["events"] + verbs: ["create", "update", "patch", "delete"] + - apiGroups: [""] + resources: ["secrets"] + verbs: ["watch", "list"] + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "update", "patch"] + resourceNames: + - uxp-ca + - upbound-agent-public-certs + - upbound-agent-tls + - xgql-tls + - {{ .Values.upbound.controlPlane.tokenSecretName }} + {{- if .Values.billing.awsMarketplace.enabled }} + - upbound-entitlement + {{- end}} + - apiGroups: ["apps"] + resources: ["deployments"] + verbs: ["create", "update", "watch", "list"] diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/rolebinding.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/rolebinding.yaml new file mode 100644 index 000000000..aa41bb33a --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/rolebinding.yaml @@ -0,0 +1,14 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ template "bootstrapper-name" . }} + labels: + {{- include "labelsBootstrapper" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "bootstrapper-name" . }} +subjects: + - kind: ServiceAccount + name: {{ template "bootstrapper-name" . }} + namespace: {{ .Release.Namespace }} \ No newline at end of file diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/secret-entitlement.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/secret-entitlement.yaml new file mode 100644 index 000000000..7e311b629 --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/secret-entitlement.yaml @@ -0,0 +1,9 @@ +{{- if .Values.billing.awsMarketplace.enabled }} +apiVersion: v1 +kind: Secret +metadata: + name: upbound-entitlement + labels: + {{- include "labelsBootstrapper" . | nindent 4 }} +type: Opaque +{{- end }} \ No newline at end of file diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/serviceaccount.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/serviceaccount.yaml new file mode 100644 index 000000000..1768272a3 --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/serviceaccount.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "bootstrapper-name" . }} + {{- if and .Values.billing.awsMarketplace.enabled .Values.billing.awsMarketplace.iamRoleARN }} + annotations: + eks.amazonaws.com/role-arn: {{ .Values.billing.awsMarketplace.iamRoleARN | quote }} + {{- end }} + labels: + {{- include "labelsBootstrapper" . | nindent 4 }} \ No newline at end of file diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/uxp-ca-tls-secret.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/uxp-ca-tls-secret.yaml new file mode 100644 index 000000000..07163971e --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/uxp-ca-tls-secret.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: Secret +metadata: + name: uxp-ca + labels: + {{- include "labels" . | nindent 4 }} +type: Opaque diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/versions-configmap.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/versions-configmap.yaml new file mode 100644 index 000000000..008b62988 --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/bootstrapper/versions-configmap.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: universal-crossplane-config + labels: + {{- include "labelsBootstrapper" . | nindent 4 }} +data: + crossplaneVersion: {{ (trimPrefix "v" .Values.image.tag) }} + xgqlVersion: {{ (trimPrefix "v" .Values.xgql.image.tag) }} + agentVersion: {{ (trimPrefix "v" .Values.agent.image.tag) }} + uxpVersion: {{ .Chart.Version }} \ No newline at end of file diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/NOTES.txt b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/NOTES.txt new file mode 100644 index 000000000..f1c8a0c63 --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/NOTES.txt @@ -0,0 +1,8 @@ +Release: {{.Release.Name}} + +Chart Name: {{.Chart.Name}} +Chart Description: {{.Chart.Description}} +Chart Version: {{.Chart.Version}} +Chart Application Version: {{.Chart.AppVersion}} + +Kube Version: {{.Capabilities.KubeVersion}} diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/_helpers.tpl b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/_helpers.tpl new file mode 100644 index 000000000..921e9df26 --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/_helpers.tpl @@ -0,0 +1,14 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/clusterrole.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/clusterrole.yaml new file mode 100644 index 000000000..8a6b573cc --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/clusterrole.yaml @@ -0,0 +1,93 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "name" . }} + labels: + app: {{ template "name" . }} + chart: {{ template "chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +aggregationRule: + clusterRoleSelectors: + - matchLabels: + rbac.crossplane.io/aggregate-to-crossplane: "true" +rules: [] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "name" . }}:system:aggregate-to-crossplane + labels: + app: {{ template "name" . }} + chart: {{ template "chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + crossplane.io/scope: "system" + rbac.crossplane.io/aggregate-to-crossplane: "true" +rules: +- apiGroups: + - "" + resources: + - events + verbs: + - create + - update + - patch + - delete +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - "*" +- apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - watch + - create + - update + - patch +- apiGroups: + - "" + resources: + - serviceaccounts + verbs: + - "*" +- apiGroups: + - apiextensions.crossplane.io + - pkg.crossplane.io + resources: + - "*" + verbs: + - "*" +- apiGroups: + - extensions + - apps + resources: + - deployments + verbs: + - get + - list + - create + - update + - patch + - delete + - watch +- apiGroups: + - "" + - coordination.k8s.io + resources: + - configmaps + - leases + verbs: + - get + - list + - create + - update + - patch + - watch + - delete diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/clusterrolebinding.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/clusterrolebinding.yaml new file mode 100644 index 000000000..d0fb877c2 --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/clusterrolebinding.yaml @@ -0,0 +1,17 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "name" . }} + labels: + app: {{ template "name" . }} + chart: {{ template "chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "name" . }} +subjects: +- kind: ServiceAccount + name: {{ template "name" . }} + namespace: {{ .Release.Namespace }} diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/deployment.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/deployment.yaml new file mode 100644 index 000000000..c8ac46d7f --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/deployment.yaml @@ -0,0 +1,106 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ template "name" . }} + labels: + app: {{ template "name" . }} + chart: {{ template "chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + replicas: {{ .Values.replicas }} + selector: + matchLabels: + app: {{ template "name" . }} + release: {{ .Release.Name }} + strategy: + type: {{ .Values.deploymentStrategy }} + template: + metadata: + {{- if .Values.metrics.enabled }} + annotations: + prometheus.io/path: /metrics + prometheus.io/port: "8080" + prometheus.io/scrape: "true" + {{- end }} + labels: + app: {{ template "name" . }} + release: {{ .Release.Name }} + spec: + securityContext: + {{- toYaml .Values.podSecurityContextCrossplane | nindent 8 }} + {{- if .Values.priorityClassName }} + priorityClassName: {{ .Values.priorityClassName | quote }} + {{- end }} + serviceAccountName: {{ template "name" . }} + initContainers: + - image: {{ .Values.image.repository }}:{{ .Values.image.tag }} + args: + - core + - init + {{- range $arg := .Values.provider.packages }} + - --provider + - "{{ $arg }}" + {{- end }} + {{- range $arg := .Values.configuration.packages }} + - --configuration + - "{{ $arg }}" + {{- end }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + name: {{ .Chart.Name }}-init + resources: + {{- toYaml .Values.resourcesCrossplane | nindent 12 }} + securityContext: + {{- toYaml .Values.securityContextCrossplane | nindent 12 }} + containers: + - image: {{ .Values.image.repository }}:{{ .Values.image.tag }} + args: + - core + - start + {{- range $arg := .Values.args }} + - {{ $arg }} + {{- end }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + name: {{ .Chart.Name }} + resources: + {{- toYaml .Values.resourcesCrossplane | nindent 12 }} + {{- if .Values.metrics.enabled }} + ports: + - name: metrics + containerPort: 8080 + {{- end }} + securityContext: + {{- toYaml .Values.securityContextCrossplane | nindent 12 }} + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: LEADER_ELECTION + value: "{{ .Values.leaderElection }}" + {{- range $key, $value := .Values.extraEnvVarsCrossplane }} + - name: {{ $key | replace "." "_" }} + value: {{ $value | quote }} + {{- end}} + volumeMounts: + - mountPath: /cache + name: package-cache + volumes: + - name: package-cache + {{- if .Values.packageCache.pvc }} + persistentVolumeClaim: + claimName: {{ .Values.packageCache.pvc }} + {{- else }} + emptyDir: + medium: {{ .Values.packageCache.medium }} + sizeLimit: {{ .Values.packageCache.sizeLimit }} + {{- end }} + {{- if .Values.nodeSelector }} + nodeSelector: {{ toYaml .Values.nodeSelector | nindent 8 }} + {{- end }} + {{- if .Values.tolerations }} + tolerations: {{ toYaml .Values.tolerations | nindent 8 }} + {{- end }} + {{- if .Values.affinity }} + affinity: {{ toYaml .Values.affinity | nindent 8 }} + {{- end }} \ No newline at end of file diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/rbac-manager-allowed-provider-permissions.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/rbac-manager-allowed-provider-permissions.yaml new file mode 100644 index 000000000..3b6ce2270 --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/rbac-manager-allowed-provider-permissions.yaml @@ -0,0 +1,16 @@ +{{- if .Values.rbacManager.deploy }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "name" . }}:allowed-provider-permissions + labels: + app: {{ template "name" . }} + chart: {{ template "chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +aggregationRule: + clusterRoleSelectors: + - matchLabels: + rbac.crossplane.io/aggregate-to-allowed-provider-permissions: "true" +{{- end}} \ No newline at end of file diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/rbac-manager-clusterrole.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/rbac-manager-clusterrole.yaml new file mode 100644 index 000000000..de8478697 --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/rbac-manager-clusterrole.yaml @@ -0,0 +1,94 @@ +{{- if .Values.rbacManager.deploy }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "name" . }}-rbac-manager + labels: + app: {{ template "name" . }} + chart: {{ template "chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +rules: +- apiGroups: + - "" + resources: + - events + verbs: + - create + - update + - patch + - delete +- apiGroups: + - "" + resources: + - namespaces + - serviceaccounts + verbs: + - get + - list + - watch +- apiGroups: + - apiextensions.crossplane.io + resources: + - compositeresourcedefinitions + verbs: + - get + - list + - watch +- apiGroups: + - pkg.crossplane.io + resources: + - providerrevisions + verbs: + - get + - list + - watch +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + - roles + verbs: + - get + - list + - watch + - create + - update + - patch + # The RBAC manager may grant access it does not have. + - escalate +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + verbs: + - bind +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterrolebindings + verbs: + - "*" +- apiGroups: + - "" + - coordination.k8s.io + resources: + - configmaps + - leases + verbs: + - get + - list + - create + - update + - patch + - watch + - delete +{{- end}} diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/rbac-manager-clusterrolebinding.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/rbac-manager-clusterrolebinding.yaml new file mode 100644 index 000000000..bda467f24 --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/rbac-manager-clusterrolebinding.yaml @@ -0,0 +1,19 @@ +{{- if .Values.rbacManager.deploy }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "name" . }}-rbac-manager + labels: + app: {{ template "name" . }} + chart: {{ template "chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "name" . }}-rbac-manager +subjects: +- kind: ServiceAccount + name: rbac-manager + namespace: {{ .Release.Namespace }} +{{- end}} \ No newline at end of file diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/rbac-manager-deployment.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/rbac-manager-deployment.yaml new file mode 100644 index 000000000..c36144e70 --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/rbac-manager-deployment.yaml @@ -0,0 +1,87 @@ +{{- if .Values.rbacManager.deploy }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ template "name" . }}-rbac-manager + labels: + app: {{ template "name" . }}-rbac-manager + chart: {{ template "chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + replicas: {{ .Values.rbacManager.replicas }} + selector: + matchLabels: + app: {{ template "name" . }}-rbac-manager + release: {{ .Release.Name }} + strategy: + type: {{ .Values.deploymentStrategy }} + template: + metadata: + {{- if .Values.metrics.enabled }} + annotations: + prometheus.io/path: /metrics + prometheus.io/port: "8080" + prometheus.io/scrape: "true" + {{- end }} + labels: + app: {{ template "name" . }}-rbac-manager + release: {{ .Release.Name }} + spec: + securityContext: + {{- toYaml .Values.podSecurityContextRBACManager | nindent 8 }} + {{- if .Values.priorityClassName }} + priorityClassName: {{ .Values.priorityClassName | quote }} + {{- end }} + serviceAccountName: rbac-manager + initContainers: + - image: {{ .Values.image.repository }}:{{ .Values.image.tag }} + args: + - rbac + - init + imagePullPolicy: {{ .Values.image.pullPolicy }} + name: {{ .Chart.Name }}-init + resources: + {{- toYaml .Values.resourcesRBACManager | nindent 12 }} + securityContext: + {{- toYaml .Values.securityContextRBACManager | nindent 12 }} + containers: + - image: {{ .Values.image.repository }}:{{ .Values.image.tag }} + args: + - rbac + - start + {{- if .Values.rbacManager.managementPolicy }} + - --manage={{ .Values.rbacManager.managementPolicy }} + {{- end }} + {{- range $arg := .Values.rbacManager.args }} + - {{ $arg }} + {{- end }} + - --provider-clusterrole={{ template "name" .}}:allowed-provider-permissions + imagePullPolicy: {{ .Values.image.pullPolicy }} + name: {{ .Chart.Name }} + resources: + {{- toYaml .Values.resourcesRBACManager | nindent 12 }} + {{- if .Values.metrics.enabled }} + ports: + - name: metrics + containerPort: 8080 + {{- end }} + securityContext: + {{- toYaml .Values.securityContextRBACManager | nindent 12 }} + env: + - name: LEADER_ELECTION + value: "{{ .Values.rbacManager.leaderElection }}" + {{- range $key, $value := .Values.extraEnvVarsRBACManager }} + - name: {{ $key | replace "." "_" }} + value: {{ $value | quote }} + {{- end}} + {{- if .Values.rbacManager.nodeSelector }} + nodeSelector: {{ toYaml .Values.rbacManager.nodeSelector | nindent 8 }} + {{- end }} + {{- if .Values.rbacManager.tolerations }} + tolerations: {{ toYaml .Values.rbacManager.tolerations | nindent 8 }} + {{- end }} + {{- if .Values.rbacManager.affinity }} + affinity: {{ toYaml .Values.rbacManager.affinity | nindent 8 }} + {{- end }} +{{- end}} diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/rbac-manager-managed-clusterroles.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/rbac-manager-managed-clusterroles.yaml new file mode 100644 index 000000000..3d41fb9b5 --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/rbac-manager-managed-clusterroles.yaml @@ -0,0 +1,279 @@ +{{- if .Values.rbacManager.deploy }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "name" . }}-admin +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "name" . }}-admin +subjects: +- apiGroup: rbac.authorization.k8s.io + kind: Group + name: {{ template "name" . }}:masters +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "name" . }}-admin + labels: + app: {{ template "name" . }} + chart: {{ template "chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +aggregationRule: + clusterRoleSelectors: + - matchLabels: + rbac.crossplane.io/aggregate-to-admin: "true" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "name" . }}-edit + labels: + app: {{ template "name" . }} + chart: {{ template "chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +aggregationRule: + clusterRoleSelectors: + - matchLabels: + rbac.crossplane.io/aggregate-to-edit: "true" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "name" . }}-view + labels: + app: {{ template "name" . }} + chart: {{ template "chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +aggregationRule: + clusterRoleSelectors: + - matchLabels: + rbac.crossplane.io/aggregate-to-view: "true" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "name" . }}-browse + labels: + app: {{ template "name" . }} + chart: {{ template "chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +aggregationRule: + clusterRoleSelectors: + - matchLabels: + rbac.crossplane.io/aggregate-to-browse: "true" +{{- if not .Values.rbacManager.skipAggregatedClusterRoles }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "name" . }}:aggregate-to-admin + labels: + rbac.crossplane.io/aggregate-to-admin: "true" + app: {{ template "name" . }} + chart: {{ template "chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +rules: +# Crossplane administrators have access to view events. +- apiGroups: [""] + resources: [events] + verbs: [get, list, watch] +# Crossplane administrators must create provider credential secrets, and may +# need to read or otherwise interact with connection secrets. They may also need +# to create or annotate namespaces. +- apiGroups: [""] + resources: [secrets, namespaces] + verbs: ["*"] +# Crossplane administrators have access to view the roles that they may be able +# to grant to other subjects. +- apiGroups: [rbac.authorization.k8s.io] + resources: [clusterroles, roles] + verbs: [get, list, watch] +# Crossplane administrators have access to grant the access they have to other +# subjects. +- apiGroups: [rbac.authorization.k8s.io] + resources: [clusterrolebindings, rolebindings] + verbs: ["*"] +# Crossplane administrators have full access to built in Crossplane types. +- apiGroups: + - apiextensions.crossplane.io + resources: ["*"] + verbs: ["*"] +- apiGroups: + - pkg.crossplane.io + resources: [providers, configurations, providerrevisions, configurationrevisions] + verbs: ["*"] +# Crossplane administrators have access to view CRDs in order to debug XRDs. +- apiGroups: [apiextensions.k8s.io] + resources: [customresourcedefinitions] + verbs: [get, list, watch] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "name" . }}:aggregate-to-edit + labels: + rbac.crossplane.io/aggregate-to-edit: "true" + app: {{ template "name" . }} + chart: {{ template "chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +rules: +# Crossplane editors have access to view events. +- apiGroups: [""] + resources: [events] + verbs: [get, list, watch] +# Crossplane editors must create provider credential secrets, and may need to +# read or otherwise interact with connection secrets. +- apiGroups: [""] + resources: [secrets] + verbs: ["*"] +# Crossplane editors may see which namespaces exist, but not edit them. +- apiGroups: [""] + resources: [namespaces] + verbs: [get, list, watch] +# Crossplane editors have full access to built in Crossplane types. +- apiGroups: + - apiextensions.crossplane.io + resources: ["*"] + verbs: ["*"] +- apiGroups: + - pkg.crossplane.io + resources: [providers, configurations, providerrevisions, configurationrevisions] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "name" . }}:aggregate-to-view + labels: + rbac.crossplane.io/aggregate-to-view: "true" + app: {{ template "name" . }} + chart: {{ template "chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +rules: +# Crossplane viewers have access to view events. +- apiGroups: [""] + resources: [events] + verbs: [get, list, watch] +# Crossplane viewers may see which namespaces exist. +- apiGroups: [""] + resources: [namespaces] + verbs: [get, list, watch] +# Crossplane viewers have read-only access to built in Crossplane types. +- apiGroups: + - apiextensions.crossplane.io + resources: ["*"] + verbs: [get, list, watch] +- apiGroups: + - pkg.crossplane.io + resources: [providers, configurations, providerrevisions, configurationrevisions] + verbs: [get, list, watch] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "name" . }}:aggregate-to-browse + labels: + rbac.crossplane.io/aggregate-to-browse: "true" + app: {{ template "name" . }} + chart: {{ template "chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +rules: +# Crossplane browsers have access to view events. +- apiGroups: [""] + resources: [events] + verbs: [get, list, watch] +# Crossplane browsers have read-only access to compositions and XRDs. This +# allows them to discover and select an appropriate composition when creating a +# resource claim. +- apiGroups: + - apiextensions.crossplane.io + resources: ["*"] + verbs: [get, list, watch] +{{- if .Values.rbacManager.managementPolicy }} +--- +# The below ClusterRoles are aggregated to the namespaced RBAC roles created by +# the Crossplane RBAC manager when it is running in --manage=All mode. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "name" . }}:aggregate-to-ns-admin + labels: + rbac.crossplane.io/aggregate-to-ns-admin: "true" + rbac.crossplane.io/base-of-ns-admin: "true" + app: {{ template "name" . }} + chart: {{ template "chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +rules: +# Crossplane namespace admins have access to view events. +- apiGroups: [""] + resources: [events] + verbs: [get, list, watch] +# Crossplane namespace admins may need to read or otherwise interact with +# resource claim connection secrets. +- apiGroups: [""] + resources: [secrets] + verbs: ["*"] +# Crossplane namespace admins have access to view the roles that they may be +# able to grant to other subjects. +- apiGroups: [rbac.authorization.k8s.io] + resources: [roles] + verbs: [get, list, watch] +# Crossplane namespace admins have access to grant the access they have to other +# subjects. +- apiGroups: [rbac.authorization.k8s.io] + resources: [rolebindings] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "name" . }}:aggregate-to-ns-edit + labels: + rbac.crossplane.io/aggregate-to-ns-edit: "true" + rbac.crossplane.io/base-of-ns-edit: "true" + app: {{ template "name" . }} + chart: {{ template "chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +rules: +# Crossplane namespace editors have access to view events. +- apiGroups: [""] + resources: [events] + verbs: [get, list, watch] +# Crossplane namespace editors may need to read or otherwise interact with +# resource claim connection secrets. +- apiGroups: [""] + resources: [secrets] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "name" . }}:aggregate-to-ns-view + labels: + rbac.crossplane.io/aggregate-to-ns-view: "true" + rbac.crossplane.io/base-of-ns-view: "true" + app: {{ template "name" . }} + chart: {{ template "chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +rules: +# Crossplane namespace viewers have access to view events. +- apiGroups: [""] + resources: [events] + verbs: [get, list, watch] +{{- end }} +{{- end }} +{{- end }} diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/rbac-manager-serviceaccount.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/rbac-manager-serviceaccount.yaml new file mode 100644 index 000000000..dfefe4050 --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/rbac-manager-serviceaccount.yaml @@ -0,0 +1,11 @@ +{{- if .Values.rbacManager.deploy }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: rbac-manager + labels: + app: {{ template "name" . }} + chart: {{ template "chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +{{- end}} \ No newline at end of file diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/serviceaccount.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/serviceaccount.yaml new file mode 100644 index 000000000..d3d47223c --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/crossplane/serviceaccount.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "name" . }} + labels: + app: {{ template "name" . }} + chart: {{ template "chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +{{- if .Values.imagePullSecrets }} +imagePullSecrets: +{{- range $index, $secret := .Values.imagePullSecrets }} +- name: {{ $secret }} +{{- end }} +{{ end }} diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/_deployment-spec.tpl b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/_deployment-spec.tpl new file mode 100644 index 000000000..281f34e72 --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/_deployment-spec.tpl @@ -0,0 +1,87 @@ +{{- define "agent-spec" -}} +replicas: 1 +selector: + matchLabels: + {{- include "selectorLabelsAgent" . | nindent 8 }} +template: + metadata: + labels: + {{- include "selectorLabelsAgent" . | nindent 10 }} + spec: + serviceAccountName: {{ template "agent-name" . }} + {{- if .Values.imagePullSecrets }} + imagePullSecrets: + {{- range $index, $secret := .Values.imagePullSecrets }} + - name: {{ $secret }} + {{- end }} + {{ end }} + containers: + - name: agent + image: "{{ .Values.agent.image.repository }}:{{ .Values.agent.image.tag }}" + args: + - agent + - --tls-cert-file + - /etc/certs/upbound-agent/tls.crt + - --tls-key-file + - /etc/certs/upbound-agent/tls.key + - --xgql-ca-bundle-file + - /etc/certs/upbound-agent/ca.crt + - --nats-endpoint + - nats://{{ .Values.upbound.connectHost }}:{{ .Values.upbound.connectPort | default "443" }} + - --upbound-api-endpoint + - {{ .Values.upbound.apiURL }} + {{- if .Values.agent.config.debugMode }} + - "--debug" + {{- end }} + {{- range $arg := .Values.agent.config.args }} + - {{ $arg }} + {{- end }} + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: CONTROL_PLANE_TOKEN + valueFrom: + secretKeyRef: + name: {{ .Values.upbound.controlPlane.tokenSecretName }} + key: token + {{- range $key, $value := .Values.agent.config.envVars }} + - name: {{ $key | replace "." "_" }} + value: {{ $value | quote }} + {{- end}} + imagePullPolicy: {{ .Values.agent.image.pullPolicy }} + ports: + - name: agent + containerPort: 6443 + protocol: TCP + resources: + {{- toYaml .Values.agent.resources | nindent 14 }} + readinessProbe: + httpGet: + scheme: HTTPS + path: /readyz + port: 6443 + initialDelaySeconds: 5 + timeoutSeconds: 5 + periodSeconds: 5 + failureThreshold: 3 + livenessProbe: + httpGet: + scheme: HTTPS + path: /livez + port: 6443 + initialDelaySeconds: 10 + timeoutSeconds: 5 + periodSeconds: 30 + failureThreshold: 5 + volumeMounts: + - mountPath: /etc/certs/upbound-agent + name: certs + readOnly: true + volumes: + - name: certs + secret: + defaultMode: 420 + secretName: upbound-agent-tls +{{- end }} \ No newline at end of file diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/_helpers.tpl b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/_helpers.tpl new file mode 100644 index 000000000..4db04bfaa --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/_helpers.tpl @@ -0,0 +1,22 @@ +{{/* vim: set filetype=mustache: */}} + +{{- define "agent-name" -}} +{{- "upbound-agent" -}} +{{- end -}} + +{{/* +Labels - agent +*/}} +{{- define "labelsAgent" -}} +{{ include "labels" . }} +app.kubernetes.io/component: agent +{{- end }} + +{{/* +Selector labels - agent +*/}} +{{- define "selectorLabelsAgent" -}} +{{ include "selectorLabels" . }} +app.kubernetes.io/component: agent +{{- end }} + diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/clusterrole.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/clusterrole.yaml new file mode 100644 index 000000000..9dc24441e --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/clusterrole.yaml @@ -0,0 +1,40 @@ +{{- if or (eq .Values.upbound.controlPlane.permission "view") (eq .Values.upbound.controlPlane.permission "edit") }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "agent-name" . }} + labels: + {{- include "labelsAgent" . | nindent 4 }} +rules: + - apiGroups: [""] + resources: ["namespaces"] + resourceNames: ["kube-system"] + verbs: ["get"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "agent-name" . }}-impersonator + labels: + {{- include "labelsAgent" . | nindent 4 }} +rules: + - apiGroups: [""] + resources: ["users"] + verbs: ["impersonate"] + resourceNames: ["upbound-cloud-impersonator"] + - apiGroups: ["authentication.k8s.io"] + resources: ["userextras/upbound-id"] + verbs: ["impersonate"] + - apiGroups: [""] + resources: ["groups"] + resourceNames: + # system:authenticated is required for calls to discovery API. Some Kubernetes + # clients like kubectl use it to figure out exactly which endpoints to call + # for given arguments. + - "system:authenticated" + - "upbound:view" +{{- if eq .Values.upbound.controlPlane.permission "edit" }} + - "upbound:edit" +{{- end }} + verbs: ["impersonate"] +{{- end }} \ No newline at end of file diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/clusterrolebindings-managed.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/clusterrolebindings-managed.yaml new file mode 100644 index 000000000..66e157620 --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/clusterrolebindings-managed.yaml @@ -0,0 +1,34 @@ +{{- if or (eq .Values.upbound.controlPlane.permission "view") (eq .Values.upbound.controlPlane.permission "edit") }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "name" . }}-view + labels: + {{- include "labelsAgent" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "name" . }}-view +subjects: + - apiGroup: rbac.authorization.k8s.io + kind: Group + name: upbound:view +{{- if eq .Values.upbound.controlPlane.permission "edit" }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "name" . }}-edit + labels: + {{- include "labelsAgent" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "name" . }}-edit +subjects: + - apiGroup: rbac.authorization.k8s.io + kind: Group + name: upbound:edit +{{- end }} +{{- end }} \ No newline at end of file diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/clusterrolebindings.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/clusterrolebindings.yaml new file mode 100644 index 000000000..ec99faf43 --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/clusterrolebindings.yaml @@ -0,0 +1,31 @@ +{{- if or (eq .Values.upbound.controlPlane.permission "view") (eq .Values.upbound.controlPlane.permission "edit") }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "agent-name" . }} + labels: + {{- include "labelsAgent" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "agent-name" . }} +subjects: +- kind: ServiceAccount + name: {{ template "agent-name" . }} + namespace: {{ .Release.Namespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "agent-name" . }}-impersonator + labels: + {{- include "labelsAgent" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "agent-name" . }}-impersonator +subjects: + - kind: ServiceAccount + name: {{ template "agent-name" . }} + namespace: {{ .Release.Namespace }} +{{- end }} \ No newline at end of file diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/clusterroles-managed.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/clusterroles-managed.yaml new file mode 100644 index 000000000..fcca427a0 --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/clusterroles-managed.yaml @@ -0,0 +1,66 @@ +{{- if or (eq .Values.upbound.controlPlane.permission "view") (eq .Values.upbound.controlPlane.permission "edit") }} +# There are more permissions in upstream aggregated ClusterRoles than we'd like +# to have, so, we have our own ClusterRoles with only the permissions we need. +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "name" . }}:aggregate-to-view + labels: + rbac.crossplane.io/aggregate-to-view: "true" + {{- include "labelsAgent" . | nindent 4 }} +rules: + # Universal Crossplane viewers have access to view events. + - apiGroups: [""] + resources: [events] + verbs: [get, list, watch] + # Universal Crossplane viewers may see which namespaces exist. + - apiGroups: [""] + resources: [namespaces] + verbs: [get, list, watch] + # Universal Crossplane viewers may see CRDs installed in the cluster. + - apiGroups: [apiextensions.k8s.io] + resources: [customresourcedefinitions] + verbs: [get, list, watch] + # Universal Crossplane viewers have read-only access to built in Crossplane types. + - apiGroups: + - apiextensions.crossplane.io + resources: ["*"] + verbs: [get, list, watch] + - apiGroups: + - pkg.crossplane.io + resources: [providers, configurations, providerrevisions, configurationrevisions] + verbs: [get, list, watch] +{{- if eq .Values.upbound.controlPlane.permission "edit" }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "name" . }}:aggregate-to-edit + labels: + rbac.crossplane.io/aggregate-to-edit: "true" + {{- include "labelsAgent" . | nindent 4 }} +rules: + # Universal Crossplane editors have access to view events. + - apiGroups: [""] + resources: [events] + verbs: [get, list, watch] + # Universal Crossplane editors may see which namespaces exist, but not edit them. + - apiGroups: [""] + resources: [namespaces] + verbs: [get, list, watch] + # Universal Crossplane editors may see CRDs installed in the cluster. + - apiGroups: [apiextensions.k8s.io] + resources: [customresourcedefinitions] + verbs: [get, list, watch] + # Universal Crossplane editors have full access to built in Crossplane types. + - apiGroups: + - apiextensions.crossplane.io + resources: ["*"] + verbs: ["*"] + - apiGroups: + - pkg.crossplane.io + resources: [providers, configurations, providerrevisions, configurationrevisions] + verbs: ["*"] +{{- end }} +{{- end }} \ No newline at end of file diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/control-plane-token-secret.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/control-plane-token-secret.yaml new file mode 100644 index 000000000..897846ae7 --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/control-plane-token-secret.yaml @@ -0,0 +1,11 @@ +{{- if .Values.upbound.controlPlane.token }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ .Values.upbound.controlPlane.tokenSecretName }} + labels: + {{- include "labels" . | nindent 4 }} +type: Opaque +data: + token: {{ .Values.upbound.controlPlane.token | b64enc | quote }} +{{- end }} \ No newline at end of file diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/role.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/role.yaml new file mode 100644 index 000000000..960bc4d48 --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/role.yaml @@ -0,0 +1,66 @@ +{{- if or (eq .Values.upbound.controlPlane.permission "view") (eq .Values.upbound.controlPlane.permission "edit") }} +--- +# We need to be able to read universal-crossplane-config configmap in the namespace +# where UXP is deployed to provide version/configuration information. +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ template "agent-name" . }}-uxp-config + labels: + {{- include "labelsAgent" . | nindent 4 }} +rules: + - apiGroups: [""] + resources: ["configmaps"] + resourceNames: ["universal-crossplane-config"] + verbs: ["get"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ template "agent-name" . }}-uxp-config + labels: + {{- include "labelsAgent" . | nindent 4 }} +subjects: + - apiGroup: rbac.authorization.k8s.io + kind: Group + name: upbound:view +{{- if eq .Values.upbound.controlPlane.permission "edit" }} + - apiGroup: rbac.authorization.k8s.io + kind: Group + name: upbound:edit +{{- end }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "agent-name" . }}-uxp-config +{{- end }} +{{- if eq .Values.upbound.controlPlane.permission "edit" }} +--- +# We need to be able to manage Secrets in the namespace where UXP is deployed +# so that Secrets pointed by ProviderConfig objects can be created by the agent. +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ template "agent-name" . }}-secret + labels: + {{- include "labelsAgent" . | nindent 4 }} +rules: + - apiGroups: [""] + resources: ["secrets"] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ template "agent-name" . }}-secret + labels: + {{- include "labelsAgent" . | nindent 4 }} +subjects: + - apiGroup: rbac.authorization.k8s.io + kind: Group + name: upbound:edit +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "agent-name" . }}-secret +{{- end }} \ No newline at end of file diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/service.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/service.yaml new file mode 100644 index 000000000..7e22879a3 --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/service.yaml @@ -0,0 +1,16 @@ +{{- if or (eq .Values.upbound.controlPlane.permission "view") (eq .Values.upbound.controlPlane.permission "edit") }} +apiVersion: v1 +kind: Service +metadata: + name: {{ template "agent-name" . }} + labels: + {{- include "labelsAgent" . | nindent 4 }} +spec: + selector: + {{- include "selectorLabelsAgent" . | nindent 4 }} + ports: + - port: 6443 + targetPort: 6443 + protocol: TCP + name: https +{{- end }} \ No newline at end of file diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/serviceaccount.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/serviceaccount.yaml new file mode 100644 index 000000000..fe136d5c0 --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/serviceaccount.yaml @@ -0,0 +1,8 @@ +{{- if or (eq .Values.upbound.controlPlane.permission "view") (eq .Values.upbound.controlPlane.permission "edit") }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "agent-name" . }} + labels: + {{- include "labelsAgent" . | nindent 4 }} +{{- end }} \ No newline at end of file diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/tls-secret.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/tls-secret.yaml new file mode 100644 index 000000000..19a5c9748 --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/upbound-agent/tls-secret.yaml @@ -0,0 +1,9 @@ +{{- if or (eq .Values.upbound.controlPlane.permission "view") (eq .Values.upbound.controlPlane.permission "edit") }} +apiVersion: v1 +kind: Secret +metadata: + name: upbound-agent-tls + labels: + {{- include "labelsAgent" . | nindent 4 }} +type: Opaque +{{- end }} \ No newline at end of file diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/xgql/_helpers.tpl b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/xgql/_helpers.tpl new file mode 100644 index 000000000..bd1141516 --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/xgql/_helpers.tpl @@ -0,0 +1,22 @@ +{{/* vim: set filetype=mustache: */}} + +{{- define "xgql-name" -}} +{{- "xgql" -}} +{{- end -}} + +{{/* +Labels - xgql +*/}} +{{- define "labelsXgql" -}} +{{ include "labels" . }} +app.kubernetes.io/component: xgql +{{- end }} + +{{/* +Selector labels - xgql +*/}} +{{- define "selectorLabelsXgql" -}} +{{ include "selectorLabels" . }} +app.kubernetes.io/component: xgql +{{- end }} + diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/xgql/deployment.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/xgql/deployment.yaml new file mode 100644 index 000000000..66f3694cc --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/xgql/deployment.yaml @@ -0,0 +1,63 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ template "xgql-name" . }} + labels: + {{- include "labelsXgql" . | nindent 4 }} +spec: + selector: + matchLabels: + {{- include "selectorLabelsXgql" . | nindent 6 }} + template: + metadata: + labels: + {{- include "selectorLabelsXgql" . | nindent 8 }} + spec: + serviceAccountName: {{ template "xgql-name" . }} + {{- if .Values.imagePullSecrets }} + imagePullSecrets: + {{- range $index, $secret := .Values.imagePullSecrets }} + - name: {{ $secret }} + {{- end }} + {{ end }} + containers: + - name: xgql + image: "{{ .Values.xgql.image.repository }}:{{ .Values.xgql.image.tag }}" + imagePullPolicy: {{ .Values.xgql.image.pullPolicy }} + resources: + {{- toYaml .Values.xgql.resources | nindent 12 }} + ports: + - name: https + containerPort: 8443 + protocol: TCP + {{- if .Values.xgql.metrics.enabled }} + - name: metrics + containerPort: 8080 + {{- end }} + args: + - --tls-key=/etc/certs/xgql/tls.key + - --tls-cert=/etc/certs/xgql/tls.crt + {{- if .Values.xgql.config.debugMode }} + - "--debug" + {{- end }} + {{- range $arg := .Values.xgql.config.args }} + - {{ $arg }} + {{- end }} + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + {{- range $key, $value := .Values.xgql.config.envVars }} + - name: {{ $key | replace "." "_" }} + value: {{ $value | quote }} + {{- end}} + volumeMounts: + - mountPath: /etc/certs/xgql + name: certs + readOnly: true + volumes: + - name: certs + secret: + defaultMode: 420 + secretName: xgql-tls diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/xgql/service.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/xgql/service.yaml new file mode 100644 index 000000000..80f822d3c --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/xgql/service.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ template "xgql-name" . }} + labels: + {{- include "labelsXgql" . | nindent 4 }} +spec: + selector: + {{- include "selectorLabelsXgql" . | nindent 4 }} + ports: + - port: 443 + targetPort: https + protocol: TCP + name: https diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/xgql/serviceaccount.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/xgql/serviceaccount.yaml new file mode 100644 index 000000000..88e8bbdb7 --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/xgql/serviceaccount.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "xgql-name" . }} + labels: + {{- include "labelsXgql" . | nindent 4 }} diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/xgql/tls-secret.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/xgql/tls-secret.yaml new file mode 100644 index 000000000..4b06ca735 --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/templates/xgql/tls-secret.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: Secret +metadata: + name: xgql-tls + labels: + {{- include "labelsXgql" . | nindent 4 }} +type: Opaque diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/values.yaml b/charts/universal-crossplane/universal-crossplane/1.4.300101/values.yaml new file mode 100644 index 000000000..58a648af4 --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/values.yaml @@ -0,0 +1,185 @@ +nameOverride: "crossplane" + +replicas: 1 + +deploymentStrategy: RollingUpdate + +image: + repository: upbound/crossplane + tag: v1.4.3-up.1 + pullPolicy: IfNotPresent + +nodeSelector: {} +tolerations: {} +affinity: {} + +leaderElection: true +args: {} + +provider: + packages: [] + +configuration: + packages: [] + +imagePullSecrets: + - dockerhub + +rbacManager: + deploy: true + skipAggregatedClusterRoles: true + replicas: 1 + managementPolicy: Basic + leaderElection: true + args: {} + nodeSelector: {} + tolerations: {} + affinity: {} + +priorityClassName: "" + +resourcesCrossplane: + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 100m + memory: 256Mi + +securityContextCrossplane: + runAsUser: 65532 + runAsGroup: 65532 + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + +packageCache: + medium: "" + sizeLimit: 5Mi + pvc: "" + +resourcesRBACManager: + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 100m + memory: 256Mi + +securityContextRBACManager: + runAsUser: 65532 + runAsGroup: 65532 + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + +metrics: + enabled: false + +# List of extra environment variables to set in the crossplane deployment. +# EXAMPLE +# extraEnvironmentVars: +# sample.key: value1 +# ANOTHER.KEY: value2 +# RESULT +# - name: sample_key +# value: "value1" +# - name: ANOTHER_KEY +# value: "value2" +extraEnvVarsCrossplane: {} + +# List of extra environment variables to set in the crossplane rbac manager deployment. +# EXAMPLE +# extraEnvironmentVars: +# sample.key: value1 +# ANOTHER.KEY: value2 +# RESULT +# - name: sample_key +# value: "value1" +# - name: ANOTHER_KEY +# value: "value2" +extraEnvVarsRBACManager: {} + +podSecurityContextCrossplane: {} + +podSecurityContextRBACManager: {} + +### Agent Values + +upbound: + apiURL: "https://api.upbound.io" + connectHost: "connect.upbound.io" + controlPlane: + permission: edit + tokenSecretName: upbound-control-plane-token + token: "" + +xgql: + image: + repository: upbound/xgql + tag: v0.1.5 + pullPolicy: IfNotPresent + resources: {} + metrics: + enabled: false + config: + debugMode: false + args: [] + envVars: {} + # List of extra environment variables to set in the xgql deployment. + # EXAMPLE + # envVars: + # sample.key: value1 + # ANOTHER.KEY: value2 + # RESULT + # - name: sample_key + # value: "value1" + # - name: ANOTHER_KEY + # value: "value2" + +agent: + image: + repository: upbound/upbound-agent + tag: v1.4.3-up.1 + pullPolicy: IfNotPresent + resources: {} + config: + debugMode: false + args: [] + envVars: {} + # List of extra environment variables to set in the agent deployment. + # EXAMPLE + # envVars: + # sample.key: value1 + # ANOTHER.KEY: value2 + # RESULT + # - name: sample_key + # value: "value1" + # - name: ANOTHER_KEY + # value: "value2" + +### Bootstrapper Values + +bootstrapper: + image: + repository: upbound/uxp-bootstrapper + tag: v1.4.3-up.1 + pullPolicy: IfNotPresent + resources: {} + config: + debugMode: false + args: [] + envVars: {} + # List of extra environment variables to set in the bootstrapper deployment. + # EXAMPLE + # envVars: + # sample.key: value1 + # ANOTHER.KEY: value2 + # RESULT + # - name: sample_key + # value: "value1" + # - name: ANOTHER_KEY + # value: "value2" + +billing: + awsMarketplace: + enabled: false + iamRoleARN: arn:aws:iam:::role/ diff --git a/charts/universal-crossplane/universal-crossplane/1.4.300101/values.yaml.tmpl b/charts/universal-crossplane/universal-crossplane/1.4.300101/values.yaml.tmpl new file mode 100644 index 000000000..2e91ec174 --- /dev/null +++ b/charts/universal-crossplane/universal-crossplane/1.4.300101/values.yaml.tmpl @@ -0,0 +1,185 @@ +nameOverride: "crossplane" + +replicas: 1 + +deploymentStrategy: RollingUpdate + +image: + repository: upbound/crossplane + tag: %%CROSSPLANE_TAG%% + pullPolicy: IfNotPresent + +nodeSelector: {} +tolerations: {} +affinity: {} + +leaderElection: true +args: {} + +provider: + packages: [] + +configuration: + packages: [] + +imagePullSecrets: + - dockerhub + +rbacManager: + deploy: true + skipAggregatedClusterRoles: true + replicas: 1 + managementPolicy: Basic + leaderElection: true + args: {} + nodeSelector: {} + tolerations: {} + affinity: {} + +priorityClassName: "" + +resourcesCrossplane: + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 100m + memory: 256Mi + +securityContextCrossplane: + runAsUser: 65532 + runAsGroup: 65532 + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + +packageCache: + medium: "" + sizeLimit: 5Mi + pvc: "" + +resourcesRBACManager: + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 100m + memory: 256Mi + +securityContextRBACManager: + runAsUser: 65532 + runAsGroup: 65532 + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + +metrics: + enabled: false + +# List of extra environment variables to set in the crossplane deployment. +# EXAMPLE +# extraEnvironmentVars: +# sample.key: value1 +# ANOTHER.KEY: value2 +# RESULT +# - name: sample_key +# value: "value1" +# - name: ANOTHER_KEY +# value: "value2" +extraEnvVarsCrossplane: {} + +# List of extra environment variables to set in the crossplane rbac manager deployment. +# EXAMPLE +# extraEnvironmentVars: +# sample.key: value1 +# ANOTHER.KEY: value2 +# RESULT +# - name: sample_key +# value: "value1" +# - name: ANOTHER_KEY +# value: "value2" +extraEnvVarsRBACManager: {} + +podSecurityContextCrossplane: {} + +podSecurityContextRBACManager: {} + +### Agent Values + +upbound: + apiURL: "https://api.upbound.io" + connectHost: "connect.upbound.io" + controlPlane: + permission: edit + tokenSecretName: upbound-control-plane-token + token: "" + +xgql: + image: + repository: upbound/xgql + tag: %%XGQL_TAG%% + pullPolicy: IfNotPresent + resources: {} + metrics: + enabled: false + config: + debugMode: false + args: [] + envVars: {} + # List of extra environment variables to set in the xgql deployment. + # EXAMPLE + # envVars: + # sample.key: value1 + # ANOTHER.KEY: value2 + # RESULT + # - name: sample_key + # value: "value1" + # - name: ANOTHER_KEY + # value: "value2" + +agent: + image: + repository: upbound/upbound-agent + tag: %%AGENT_TAG%% + pullPolicy: IfNotPresent + resources: {} + config: + debugMode: false + args: [] + envVars: {} + # List of extra environment variables to set in the agent deployment. + # EXAMPLE + # envVars: + # sample.key: value1 + # ANOTHER.KEY: value2 + # RESULT + # - name: sample_key + # value: "value1" + # - name: ANOTHER_KEY + # value: "value2" + +### Bootstrapper Values + +bootstrapper: + image: + repository: upbound/uxp-bootstrapper + tag: %%BOOTSTRAPPER_TAG%% + pullPolicy: IfNotPresent + resources: {} + config: + debugMode: false + args: [] + envVars: {} + # List of extra environment variables to set in the bootstrapper deployment. + # EXAMPLE + # envVars: + # sample.key: value1 + # ANOTHER.KEY: value2 + # RESULT + # - name: sample_key + # value: "value1" + # - name: ANOTHER_KEY + # value: "value2" + +billing: + awsMarketplace: + enabled: false + iamRoleARN: arn:aws:iam:::role/ diff --git a/index.yaml b/index.yaml index 19cf8599e..215b37b43 100755 --- a/index.yaml +++ b/index.yaml @@ -2423,6 +2423,50 @@ entries: - assets/traefik/traefik-10.6.0.tgz version: 10.6.0 universal-crossplane: + - annotations: + catalog.cattle.io/certified: partner + catalog.cattle.io/display-name: Upbound Universal Crossplane + catalog.cattle.io/release-name: universal-crossplane + apiVersion: v1 + appVersion: 1.4.3001 + created: "2021-12-09T08:45:29.476849+03:00" + description: Upbound Universal Crossplane (UXP) is Upbound's official enterprise-grade + distribution of Crossplane. + digest: 940ffad0fb56515de69f021e094530808b62af714c071c894a505ce6d27ed31a + home: https://upbound.io + icon: https://raw.githubusercontent.com/upbound/universal-crossplane/66ce9eb2c5a0c3af8ed7d19551a2c4d743b933b9/docs/media/logo.png + keywords: + - cloud + - infrastructure + - services + - application + - database + - cache + - bucket + - infra + - app + - ops + - oam + - gcp + - azure + - aws + - alibaba + - cloudsql + - rds + - s3 + - azuredatabase + - asparadb + - gke + - aks + - eks + kubeVersion: '>= 1.15' + maintainers: + - email: info@upbound.io + name: Upbound Inc. + name: universal-crossplane + urls: + - assets/universal-crossplane/universal-crossplane-1.4.300101.tgz + version: 1.4.300101 - annotations: catalog.cattle.io/certified: partner catalog.cattle.io/display-name: Upbound Universal Crossplane