github-personal/cozystack
1
0
Fork 0
mirror of https://github.com/outbackdingo/cozystack.git synced 2026-01-27 18:18:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #95 from aenix-io/etcd-operator

Browse Source 
Replace kamaji-etcd with aenix-io/etcd-operator
This commit is contained in:
Marian Koreniuk
2024-05-02 22:42:52 +02:00
committed by GitHub
parent 66f963bfd0 be508fd107
commit dee190ad4f
36 changed files with 2269 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
packages/core/platform/bundles/distro-full.yaml
View File

@@ -52,6 +52,12 @@ releases:
privileged: true
dependsOn: [cilium]
- name: etcd-operator
releaseName: etcd-operator
chart: cozy-etcd-operator
namespace: cozy-etcd-operator
dependsOn: [cilium,cert-manager]
- name: grafana-operator
releaseName: grafana-operator
chart: cozy-grafana-operator

6
packages/core/platform/bundles/distro-hosted.yaml
View File

@@ -26,6 +26,12 @@ releases:
privileged: true
dependsOn: [victoria-metrics-operator]
- name: etcd-operator
releaseName: etcd-operator
chart: cozy-etcd-operator
namespace: cozy-etcd-operator
dependsOn: [cert-manager]
- name: grafana-operator
releaseName: grafana-operator
chart: cozy-grafana-operator

6
packages/core/platform/bundles/paas-full.yaml
View File

@@ -81,6 +81,12 @@ releases:
privileged: true
dependsOn: [cilium,kubeovn]
- name: etcd-operator
releaseName: etcd-operator
chart: cozy-etcd-operator
namespace: cozy-etcd-operator
dependsOn: [cilium,kubeovn,cert-manager]
- name: grafana-operator
releaseName: grafana-operator
chart: cozy-grafana-operator

6
packages/core/platform/bundles/paas-hosted.yaml
View File

@@ -26,6 +26,12 @@ releases:
privileged: true
dependsOn: [victoria-metrics-operator]
- name: etcd-operator
releaseName: etcd-operator
chart: cozy-etcd-operator
namespace: cozy-etcd-operator
dependsOn: [cert-manager]
- name: grafana-operator
releaseName: grafana-operator
chart: cozy-grafana-operator

2
packages/core/platform/templates/helmreleases.yaml
View File

@@ -23,9 +23,11 @@ spec:
interval: 1m
releaseName: {{ $x.releaseName | default $x.name }}
install:
crds: CreateReplace
remediation:
retries: -1
upgrade:
crds: CreateReplace
remediation:
retries: -1
chart:

2
packages/extra/etcd/Chart.yaml
View File

@@ -3,4 +3,4 @@ name: etcd
description: Storage for Kubernetes clusters
icon: https://www.svgrepo.com/show/353714/etcd.svg
type: application
version: 1.0.0
version: 2.0.0

36
packages/extra/etcd/templates/datastore.yaml Normal file
View File

@@ -0,0 +1,36 @@
---
apiVersion: kamaji.clastix.io/v1alpha1
kind: DataStore
metadata:
name: {{ .Release.Namespace }}
annotations:
helm.sh/hook: post-install,post-upgrade
spec:
driver: etcd
endpoints:
- etcd-0.etcd-headless.{{ .Release.Namespace }}.svc:2379
- etcd-1.etcd-headless.{{ .Release.Namespace }}.svc:2379
- etcd-2.etcd-headless.{{ .Release.Namespace }}.svc:2379
tlsConfig:
certificateAuthority:
certificate:
secretReference:
keyPath: tls.crt
name: etcd-ca-tls
namespace: {{ .Release.Namespace }}
privateKey:
secretReference:
keyPath: tls.key
name: etcd-ca-tls
namespace: {{ .Release.Namespace }}
clientCertificate:
certificate:
secretReference:
keyPath: tls.crt
name: etcd-client-tls
namespace: {{ .Release.Namespace }}
privateKey:
secretReference:
keyPath: tls.key
name: etcd-client-tls
namespace: {{ .Release.Namespace }}

167
packages/extra/etcd/templates/etcd-cluster.yaml Normal file
View File

@@ -0,0 +1,167 @@
---
apiVersion: etcd.aenix.io/v1alpha1
kind: EtcdCluster
metadata:
name: etcd
spec:
storage: {}
security:
tls:
peerTrustedCASecret: etcd-peer-ca-tls
peerSecret: etcd-peer-tls
serverSecret: etcd-server-tls
clientTrustedCASecret: etcd-ca-tls
clientSecret: etcd-client-tls
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: etcd-selfsigning-issuer
spec:
selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: etcd-peer-ca
spec:
isCA: true
usages:
- "signing"
- "key encipherment"
- "cert sign"
commonName: etcd-peer-ca
subject:
organizations:
- ACME Inc.
organizationalUnits:
- Widgets
secretName: etcd-peer-ca-tls
privateKey:
algorithm: RSA
size: 4096
issuerRef:
name: etcd-selfsigning-issuer
kind: Issuer
group: cert-manager.io
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: etcd-ca
spec:
isCA: true
usages:
- "signing"
- "key encipherment"
- "cert sign"
commonName: etcd-ca
subject:
organizations:
- ACME Inc.
organizationalUnits:
- Widgets
secretName: etcd-ca-tls
privateKey:
algorithm: RSA
size: 4096
issuerRef:
name: etcd-selfsigning-issuer
kind: Issuer
group: cert-manager.io
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: etcd-peer-issuer
spec:
ca:
secretName: etcd-peer-ca-tls
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: etcd-issuer
spec:
ca:
secretName: etcd-ca-tls
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: etcd-server
spec:
secretName: etcd-server-tls
isCA: false
usages:
- "server auth"
- "signing"
- "key encipherment"
dnsNames:
- etcd-0
- etcd-0.etcd-headless
- etcd-0.etcd-headless.{{ .Release.Namespace }}.svc
- etcd-1
- etcd-1.etcd-headless
- etcd-1.etcd-headless.{{ .Release.Namespace }}.svc
- etcd-2
- etcd-2.etcd-headless
- etcd-2.etcd-headless.{{ .Release.Namespace }}.svc
- localhost
- "127.0.0.1"
privateKey:
rotationPolicy: Always
algorithm: RSA
size: 4096
issuerRef:
name: etcd-issuer
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: etcd-peer
spec:
secretName: etcd-peer-tls
isCA: false
usages:
- "server auth"
- "client auth"
- "signing"
- "key encipherment"
dnsNames:
- etcd-0
- etcd-0.etcd-headless
- etcd-0.etcd-headless.{{ .Release.Namespace }}.svc
- etcd-1
- etcd-1.etcd-headless
- etcd-1.etcd-headless.{{ .Release.Namespace }}.svc
- etcd-2
- etcd-2.etcd-headless
- etcd-2.etcd-headless.{{ .Release.Namespace }}.svc
- localhost
- "127.0.0.1"
privateKey:
rotationPolicy: Always
algorithm: RSA
size: 4096
issuerRef:
name: etcd-peer-issuer
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: etcd-client
spec:
commonName: root
secretName: etcd-client-tls
usages:
- "signing"
- "key encipherment"
- "client auth"
privateKey:
rotationPolicy: Always
algorithm: RSA
size: 4096
issuerRef:
name: etcd-issuer
kind: Issuer

19
packages/extra/etcd/templates/kamaji-etcd.yaml
View File

@@ -1,19 +0,0 @@
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: kamaji-etcd
spec:
chart:
spec:
chart: cozy-kamaji-etcd
reconcileStrategy: Revision
sourceRef:
kind: HelmRepository
name: cozystack-system
namespace: cozy-system
version: '*'
interval: 1m0s
timeout: 5m0s
values:
kamaji-etcd:
fullnameOverride: etcd

3
packages/extra/versions_map
View File

@@ -1,3 +1,4 @@
etcd 1.0.0 HEAD
etcd 1.0.0 f7eaab0
etcd 2.0.0 HEAD
ingress 1.0.0 HEAD
monitoring 1.0.0 HEAD

3
packages/system/etcd-operator/.helmignore Normal file
View File

@@ -0,0 +1,3 @@
images
hack
.gitkeep

2
packages/system/etcd-operator/Chart.yaml Normal file
View File

@@ -0,0 +1,2 @@
name: cozy-etcd-operator
version: 0.4.0

8
packages/system/etcd-operator/Makefile Normal file
View File

@@ -0,0 +1,8 @@
NAME=etcd-operator
NAMESPACE=cozy-${NAME}
include ../../../scripts/package-system.mk
update:
rm -rf charts
helm pull oci://ghcr.io/aenix-io/charts/etcd-operator --untar --untardir charts

23
packages/system/etcd-operator/charts/etcd-operator/.helmignore Normal file
View File

@@ -0,0 +1,23 @@
# Patterns to ignore when building packages.
# This supports shell glob matching, relative path matching, and
# negation (prefixed with !). Only one pattern per line.
.DS_Store
# Common VCS dirs
.git/
.gitignore
.bzr/
.bzrignore
.hg/
.hgignore
.svn/
# Common backup files
*.swp
*.bak
*.tmp
*.orig
*~
# Various IDEs
.project
.idea/
*.tmproj
.vscode/

5
packages/system/etcd-operator/charts/etcd-operator/Chart.yaml Normal file
View File

@@ -0,0 +1,5 @@
apiVersion: v2
appVersion: v0.2.0
name: etcd-operator
type: application
version: 0.2.0

63
packages/system/etcd-operator/charts/etcd-operator/README.md Normal file
View File

@@ -0,0 +1,63 @@
# etcd-operator
![Version: 0.0.0](https://img.shields.io/badge/Version-0.0.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.0.0](https://img.shields.io/badge/AppVersion-v0.0.0-informational?style=flat-square)
## Values
| Key | Type | Default | Description |
|-----|------|---------|-------------|
| affinity | object | `{}` | |
| etcdOperator.args[0] | string | `"--health-probe-bind-address=:8081"` | |
| etcdOperator.args[1] | string | `"--metrics-bind-address=127.0.0.1:8080"` | |
| etcdOperator.args[2] | string | `"--leader-elect"` | |
| etcdOperator.envVars | object | `{}` | |
| etcdOperator.image.pullPolicy | string | `"IfNotPresent"` | |
| etcdOperator.image.repository | string | `"ghcr.io/aenix-io/etcd-operator"` | |
| etcdOperator.image.tag | string | `""` | |
| etcdOperator.livenessProbe.httpGet.path | string | `"/healthz"` | |
| etcdOperator.livenessProbe.httpGet.port | int | `8081` | |
| etcdOperator.livenessProbe.initialDelaySeconds | int | `15` | |
| etcdOperator.livenessProbe.periodSeconds | int | `20` | |
| etcdOperator.readinessProbe.httpGet.path | string | `"/readyz"` | |
| etcdOperator.readinessProbe.httpGet.port | int | `8081` | |
| etcdOperator.readinessProbe.initialDelaySeconds | int | `5` | |
| etcdOperator.readinessProbe.periodSeconds | int | `10` | |
| etcdOperator.resources.limits.cpu | string | `"500m"` | |
| etcdOperator.resources.limits.memory | string | `"128Mi"` | |
| etcdOperator.resources.requests.cpu | string | `"100m"` | |
| etcdOperator.resources.requests.memory | string | `"64Mi"` | |
| etcdOperator.securityContext.allowPrivilegeEscalation | bool | `false` | |
| etcdOperator.securityContext.capabilities.drop[0] | string | `"ALL"` | |
| etcdOperator.service.port | int | `9443` | |
| etcdOperator.service.type | string | `"ClusterIP"` | |
| fullnameOverride | string | `""` | |
| imagePullSecrets | list | `[]` | |
| kubeRbacProxy.args[0] | string | `"--secure-listen-address=0.0.0.0:8443"` | |
| kubeRbacProxy.args[1] | string | `"--upstream=http://127.0.0.1:8080/"` | |
| kubeRbacProxy.args[2] | string | `"--logtostderr=true"` | |
| kubeRbacProxy.args[3] | string | `"--v=0"` | |
| kubeRbacProxy.image.pullPolicy | string | `"IfNotPresent"` | |
| kubeRbacProxy.image.repository | string | `"gcr.io/kubebuilder/kube-rbac-proxy"` | |
| kubeRbacProxy.image.tag | string | `"v0.16.0"` | |
| kubeRbacProxy.livenessProbe | object | `{}` | |
| kubeRbacProxy.readinessProbe | object | `{}` | |
| kubeRbacProxy.resources.limits.cpu | string | `"500m"` | |
| kubeRbacProxy.resources.limits.memory | string | `"128Mi"` | |
| kubeRbacProxy.resources.requests.cpu | string | `"100m"` | |
| kubeRbacProxy.resources.requests.memory | string | `"64Mi"` | |
| kubeRbacProxy.securityContext.allowPrivilegeEscalation | bool | `false` | |
| kubeRbacProxy.securityContext.capabilities.drop[0] | string | `"ALL"` | |
| kubeRbacProxy.service.port | int | `8443` | |
| kubeRbacProxy.service.type | string | `"ClusterIP"` | |
| kubernetesClusterDomain | string | `"cluster.local"` | |
| nameOverride | string | `""` | |
| nodeSelector | object | `{}` | |
| podAnnotations | object | `{}` | |
| podLabels | object | `{}` | |
| podSecurityContext | object | `{}` | |
| replicaCount | int | `1` | |
| securityContext.runAsNonRoot | bool | `true` | |
| serviceAccount.annotations | object | `{}` | |
| serviceAccount.create | bool | `true` | |
| tolerations | list | `[]` | |

1058
packages/system/etcd-operator/charts/etcd-operator/crds/etcd-cluster.yaml Normal file
View File

File diff suppressed because it is too large Load Diff

51
packages/system/etcd-operator/charts/etcd-operator/templates/_helpers.tpl Normal file
View File

@@ -0,0 +1,51 @@
{{/*
Expand the name of the chart.
*/}}
{{- define "etcd-operator.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "etcd-operator.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- if contains $name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{- end }}
{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "etcd-operator.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Common labels
*/}}
{{- define "etcd-operator.labels" -}}
helm.sh/chart: {{ include "etcd-operator.chart" . }}
{{ include "etcd-operator.selectorLabels" . }}
{{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- end }}
{{/*
Selector labels
*/}}
{{- define "etcd-operator.selectorLabels" -}}
app.kubernetes.io/name: {{ include "etcd-operator.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}

14
packages/system/etcd-operator/charts/etcd-operator/templates/cert-manager/certificate.yml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
labels:
{{- include "etcd-operator.labels" . | nindent 4 }}
name: {{ include "etcd-operator.fullname" . }}-serving-cert
spec:
dnsNames:
- {{ include "etcd-operator.fullname" . }}-webhook-service.{{ .Release.Namespace }}.svc
- {{ include "etcd-operator.fullname" . }}-webhook-service.{{ .Release.Namespace }}.svc.{{ .Values.kubernetesClusterDomain }}
issuerRef:
kind: Issuer
name: {{ include "etcd-operator.fullname" . }}-selfsigned-issuer
secretName: webhook-server-cert

8
packages/system/etcd-operator/charts/etcd-operator/templates/cert-manager/issuer.yml Normal file
View File

@@ -0,0 +1,8 @@
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
labels:
{{- include "etcd-operator.labels" . | nindent 4 }}
name: {{ include "etcd-operator.fullname" . }}-selfsigned-issuer
spec:
selfSigned: {}

29
packages/system/etcd-operator/charts/etcd-operator/templates/cert-manager/mutatingwebhookconfiguration.yml Normal file
View File

@@ -0,0 +1,29 @@
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
annotations:
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "etcd-operator.fullname" . }}-serving-cert
labels:
{{- include "etcd-operator.labels" . | nindent 4 }}
name: {{ include "etcd-operator.fullname" . }}-mutating-webhook-configuration
webhooks:
- admissionReviewVersions:
- v1
clientConfig:
service:
name: {{ include "etcd-operator.fullname" . }}-webhook-service
namespace: {{ .Release.Namespace }}
path: /mutate-etcd-aenix-io-v1alpha1-etcdcluster
failurePolicy: Fail
name: metcdcluster.kb.io
rules:
- apiGroups:
- etcd.aenix.io
apiVersions:
- v1alpha1
operations:
- CREATE
- UPDATE
resources:
- etcdclusters
sideEffects: None

29
packages/system/etcd-operator/charts/etcd-operator/templates/cert-manager/validatingwebhookconfiguration.yml Normal file
View File

@@ -0,0 +1,29 @@
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
annotations:
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "etcd-operator.fullname" . }}-serving-cert
labels:
{{- include "etcd-operator.labels" . | nindent 4 }}
name: {{ include "etcd-operator.fullname" . }}-validating-webhook-configuration
webhooks:
- admissionReviewVersions:
- v1
clientConfig:
service:
name: {{ include "etcd-operator.fullname" . }}-webhook-service
namespace: {{ .Release.Namespace }}
path: /validate-etcd-aenix-io-v1alpha1-etcdcluster
failurePolicy: Fail
name: vetcdcluster.kb.io
rules:
- apiGroups:
- etcd.aenix.io
apiVersions:
- v1alpha1
operations:
- CREATE
- UPDATE
resources:
- etcdclusters
sideEffects: None

81
packages/system/etcd-operator/charts/etcd-operator/templates/rbac/clusterrole-manager-role.yml Normal file
View File

@@ -0,0 +1,81 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
labels:
{{- include "etcd-operator.labels" . | nindent 4 }}
name: {{ include "etcd-operator.fullname" . }}-manager-role
rules:
- apiGroups:
- ""
resources:
- configmaps
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- ""
resources:
- services
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- apps
resources:
- statefulsets
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- etcd.aenix.io
resources:
- etcdclusters
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- etcd.aenix.io
resources:
- etcdclusters/finalizers
verbs:
- update
- apiGroups:
- etcd.aenix.io
resources:
- etcdclusters/status
verbs:
- get
- patch
- update
- apiGroups:
- policy
resources:
- poddisruptionbudgets
verbs:
- create
- delete
- get
- list
- patch
- update
- watch

11
packages/system/etcd-operator/charts/etcd-operator/templates/rbac/clusterrole-metrics-reader.yml Normal file
View File

@@ -0,0 +1,11 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
labels:
{{- include "etcd-operator.labels" . | nindent 4 }}
name: {{ include "etcd-operator.fullname" . }}-metrics-reader
rules:
- nonResourceURLs:
- /metrics
verbs:
- get

19
packages/system/etcd-operator/charts/etcd-operator/templates/rbac/clusterrole-proxy-role.yml Normal file
View File

@@ -0,0 +1,19 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
labels:
{{- include "etcd-operator.labels" . | nindent 4 }}
name: {{ include "etcd-operator.fullname" . }}-proxy-role
rules:
- apiGroups:
- authentication.k8s.io
resources:
- tokenreviews
verbs:
- create
- apiGroups:
- authorization.k8s.io
resources:
- subjectaccessreviews
verbs:
- create

14
packages/system/etcd-operator/charts/etcd-operator/templates/rbac/clusterrolebinding-manager-rolebinding.yml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
labels:
{{- include "etcd-operator.labels" . | nindent 4 }}
name: {{ include "etcd-operator.fullname" . }}-manager-rolebinding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: {{ include "etcd-operator.fullname" . }}-manager-role
subjects:
- kind: ServiceAccount
name: {{ include "etcd-operator.fullname" . }}-controller-manager
namespace: {{ .Release.Namespace }}

14
packages/system/etcd-operator/charts/etcd-operator/templates/rbac/clusterrolebinding-proxy-rolebinding.yml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
labels:
{{- include "etcd-operator.labels" . | nindent 4 }}
name: {{ include "etcd-operator.fullname" . }}-proxy-rolebinding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: {{ include "etcd-operator.fullname" . }}-proxy-role
subjects:
- kind: ServiceAccount
name: {{ include "etcd-operator.fullname" . }}-controller-manager
namespace: {{ .Release.Namespace }}

38
packages/system/etcd-operator/charts/etcd-operator/templates/rbac/role-leader-election-role.yml Normal file
View File

@@ -0,0 +1,38 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
labels:
{{- include "etcd-operator.labels" . | nindent 4 }}
name: {{ include "etcd-operator.fullname" . }}-leader-election-role
rules:
- apiGroups:
- ""
resources:
- configmaps
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- apiGroups:
- coordination.k8s.io
resources:
- leases
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- apiGroups:
- ""
resources:
- events
verbs:
- create
- patch

14
packages/system/etcd-operator/charts/etcd-operator/templates/rbac/rolebinding-leader-election-rolebinding.yml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
labels:
{{- include "etcd-operator.labels" . | nindent 4 }}
name: {{ include "etcd-operator.fullname" . }}-leader-election-rolebinding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: {{ include "etcd-operator.fullname" . }}-leader-election-role
subjects:
- kind: ServiceAccount
name: {{ include "etcd-operator.fullname" . }}-controller-manager
namespace: {{ .Release.Namespace }}

16
packages/system/etcd-operator/charts/etcd-operator/templates/workload/configmap-env.yaml Normal file
View File

@@ -0,0 +1,16 @@
{{- if .Values.etcdOperator.envVars }}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "etcd-operator.labels" . }}-env
labels:
{{- include "etcd-operator.labels" . | nindent 4 }}
data:
{{- range $k, $v := .Values.etcdOperator.envVars }}
{{- if typeOf $v | eq "string" }}
{{- print (tpl $k $) ": " (tpl $v $ | quote) | nindent 2 }}
{{- else }}
{{- print (tpl $k $) ": " ($v | quote) | nindent 2 }}
{{- end }}
{{- end }}
{{- end }}

114
packages/system/etcd-operator/charts/etcd-operator/templates/workload/deployment.yml Normal file
View File

@@ -0,0 +1,114 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "etcd-operator.fullname" . }}-controller-manager
labels:
{{- include "etcd-operator.labels" . | nindent 4 }}
spec:
replicas: {{ .Values.replicaCount }}
selector:
matchLabels:
{{- include "etcd-operator.selectorLabels" . | nindent 6 }}
template:
metadata:
{{- with .Values.podAnnotations }}
annotations:
{{- toYaml . | nindent 8 }}
{{- end }}
labels:
{{- include "etcd-operator.labels" . | nindent 8 }}
{{- with .Values.podLabels }}
{{- toYaml . | nindent 8 }}
{{- end }}
spec:
{{- with .Values.imagePullSecrets }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
{{- end }}
containers:
- name: etcd-operator
image: {{ .Values.etcdOperator.image.repository }}:{{ .Values.etcdOperator.image.tag | default .Chart.AppVersion }}
imagePullPolicy: {{ .Values.etcdOperator.image.pullPolicy }}
{{- with .Values.etcdOperator.args }}
args:
{{- toYaml . | nindent 12 }}
{{- end }}
ports:
- containerPort: {{ .Values.etcdOperator.service.port }}
name: webhook-server
protocol: TCP
{{- with .Values.etcdOperator.livenessProbe }}
livenessProbe:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- with .Values.etcdOperator.readinessProbe }}
readinessProbe:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- with .Values.etcdOperator.resources }}
resources:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- with .Values.etcdOperator.securityContext }}
securityContext:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- if .Values.etcdOperator.envVars }}
envFrom:
- configMapRef:
name: {{ include "etcd-operator.fullname" . }}-env
{{- end }}
volumeMounts:
- mountPath: /tmp/k8s-webhook-server/serving-certs
name: cert
readOnly: true
- name: kube-rbac-proxy
image: {{ .Values.kubeRbacProxy.image.repository }}:{{ .Values.kubeRbacProxy.image.tag }}
imagePullPolicy: {{ .Values.kubeRbacProxy.image.pullPolicy }}
{{- with .Values.kubeRbacProxy.args }}
args:
{{- toYaml . | nindent 12 }}
{{- end }}
ports:
- containerPort: {{ .Values.kubeRbacProxy.service.port }}
name: https
protocol: TCP
{{- with .Values.kubeRbacProxy.livenessProbe }}
livenessProbe:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- with .Values.kubeRbacProxy.readinessProbe }}
readinessProbe:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- with .Values.kubeRbacProxy.resources }}
resources:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- with .Values.kubeRbacProxy.securityContext }}
securityContext:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- with .Values.podSecurityContext }}
securityContext:
{{- toYaml . | nindent 8 }}
{{- end }}
serviceAccountName: {{ include "etcd-operator.fullname" . }}-controller-manager
terminationGracePeriodSeconds: 10
volumes:
- name: cert
secret:
defaultMode: 420
secretName: webhook-server-cert
{{- with .Values.nodeSelector }}
nodeSelector:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.affinity }}
affinity:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.tolerations }}
tolerations:
{{- toYaml . | nindent 8 }}
{{- end }}

15
packages/system/etcd-operator/charts/etcd-operator/templates/workload/service-controller-manager-metrics-service.yml Normal file
View File

@@ -0,0 +1,15 @@
apiVersion: v1
kind: Service
metadata:
name: {{ include "etcd-operator.fullname" . }}-controller-manager-metrics-service
labels:
{{- include "etcd-operator.labels" . | nindent 4 }}
spec:
type: {{ .Values.kubeRbacProxy.service.type }}
ports:
- name: https
port: {{ .Values.kubeRbacProxy.service.port }}
protocol: TCP
targetPort: https
selector:
{{- include "etcd-operator.selectorLabels" . | nindent 4 }}

14
packages/system/etcd-operator/charts/etcd-operator/templates/workload/service-webhook-service.yml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: v1
kind: Service
metadata:
labels:
{{- include "etcd-operator.labels" . | nindent 4 }}
name: {{ include "etcd-operator.fullname" . }}-webhook-service
spec:
type: {{ .Values.etcdOperator.service.type }}
ports:
- port: 443
protocol: TCP
targetPort: {{ .Values.etcdOperator.service.port }}
selector:
{{- include "etcd-operator.selectorLabels" . | nindent 4 }}

12
packages/system/etcd-operator/charts/etcd-operator/templates/workload/serviceaccount.yml Normal file
View File

@@ -0,0 +1,12 @@
{{- if .Values.serviceAccount.create -}}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "etcd-operator.fullname" . }}-controller-manager
labels:
{{- include "etcd-operator.labels" . | nindent 4 }}
{{- with .Values.serviceAccount.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- end }}

284
packages/system/etcd-operator/charts/etcd-operator/values.schema.json Normal file
View File

@@ -0,0 +1,284 @@
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"affinity": {
"properties": {},
"type": "object"
},
"etcdOperator": {
"properties": {
"args": {
"items": {
"type": "string"
},
"type": "array"
},
"envVars": {
"properties": {},
"type": "object"
},
"image": {
"properties": {
"pullPolicy": {
"type": "string"
},
"repository": {
"type": "string"
},
"tag": {
"type": "string"
}
},
"type": "object"
},
"livenessProbe": {
"properties": {
"httpGet": {
"properties": {
"path": {
"type": "string"
},
"port": {
"type": "integer"
}
},
"type": "object"
},
"initialDelaySeconds": {
"type": "integer"
},
"periodSeconds": {
"type": "integer"
}
},
"type": "object"
},
"readinessProbe": {
"properties": {
"httpGet": {
"properties": {
"path": {
"type": "string"
},
"port": {
"type": "integer"
}
},
"type": "object"
},
"initialDelaySeconds": {
"type": "integer"
},
"periodSeconds": {
"type": "integer"
}
},
"type": "object"
},
"resources": {
"properties": {
"limits": {
"properties": {
"cpu": {
"type": "string"
},
"memory": {
"type": "string"
}
},
"type": "object"
},
"requests": {
"properties": {
"cpu": {
"type": "string"
},
"memory": {
"type": "string"
}
},
"type": "object"
}
},
"type": "object"
},
"securityContext": {
"properties": {
"allowPrivilegeEscalation": {
"type": "boolean"
},
"capabilities": {
"properties": {
"drop": {
"items": {
"type": "string"
},
"type": "array"
}
},
"type": "object"
}
},
"type": "object"
},
"service": {
"properties": {
"port": {
"type": "integer"
},
"type": {
"type": "string"
}
},
"type": "object"
}
},
"type": "object"
},
"fullnameOverride": {
"type": "string"
},
"imagePullSecrets": {
"type": "array"
},
"kubeRbacProxy": {
"properties": {
"args": {
"items": {
"type": "string"
},
"type": "array"
},
"image": {
"properties": {
"pullPolicy": {
"type": "string"
},
"repository": {
"type": "string"
},
"tag": {
"type": "string"
}
},
"type": "object"
},
"livenessProbe": {
"properties": {},
"type": "object"
},
"readinessProbe": {
"properties": {},
"type": "object"
},
"resources": {
"properties": {
"limits": {
"properties": {
"cpu": {
"type": "string"
},
"memory": {
"type": "string"
}
},
"type": "object"
},
"requests": {
"properties": {
"cpu": {
"type": "string"
},
"memory": {
"type": "string"
}
},
"type": "object"
}
},
"type": "object"
},
"securityContext": {
"properties": {
"allowPrivilegeEscalation": {
"type": "boolean"
},
"capabilities": {
"properties": {
"drop": {
"items": {
"type": "string"
},
"type": "array"
}
},
"type": "object"
}
},
"type": "object"
},
"service": {
"properties": {
"port": {
"type": "integer"
},
"type": {
"type": "string"
}
},
"type": "object"
}
},
"type": "object"
},
"kubernetesClusterDomain": {
"type": "string"
},
"nameOverride": {
"type": "string"
},
"nodeSelector": {
"properties": {},
"type": "object"
},
"podAnnotations": {
"properties": {},
"type": "object"
},
"podLabels": {
"properties": {},
"type": "object"
},
"podSecurityContext": {
"properties": {},
"type": "object"
},
"replicaCount": {
"type": "integer"
},
"securityContext": {
"properties": {
"runAsNonRoot": {
"type": "boolean"
}
},
"type": "object"
},
"serviceAccount": {
"properties": {
"annotations": {
"properties": {},
"type": "object"
},
"create": {
"type": "boolean"
}
},
"type": "object"
},
"tolerations": {
"type": "array"
}
},
"type": "object"
}

98
packages/system/etcd-operator/charts/etcd-operator/values.yaml Normal file
View File

@@ -0,0 +1,98 @@
etcdOperator:
image:
repository: ghcr.io/aenix-io/etcd-operator
pullPolicy: IfNotPresent
# Overrides the image tag whose default is the chart appVersion.
tag: ""
args:
- --health-probe-bind-address=:8081
- --metrics-bind-address=127.0.0.1:8080
- --leader-elect
service:
type: ClusterIP
port: 9443
envVars: {}
livenessProbe:
httpGet:
path: /healthz
port: 8081
initialDelaySeconds: 15
periodSeconds: 20
readinessProbe:
httpGet:
path: /readyz
port: 8081
initialDelaySeconds: 5
periodSeconds: 10
resources:
limits:
cpu: 500m
memory: 128Mi
requests:
cpu: 100m
memory: 64Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
kubeRbacProxy:
image:
repository: gcr.io/kubebuilder/kube-rbac-proxy
pullPolicy: IfNotPresent
tag: v0.16.0
args:
- --secure-listen-address=0.0.0.0:8443
- --upstream=http://127.0.0.1:8080/
- --logtostderr=true
- --v=0
service:
type: ClusterIP
port: 8443
livenessProbe: {}
readinessProbe: {}
resources:
limits:
cpu: 500m
memory: 128Mi
requests:
cpu: 100m
memory: 64Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
kubernetesClusterDomain: cluster.local
replicaCount: 1
imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""
serviceAccount:
# Specifies whether a service account should be created
create: true
# Annotations to add to the service account
annotations: {}
podAnnotations: {}
podLabels: {}
podSecurityContext: {}
# fsGroup: 2000
securityContext:
runAsNonRoot: true
nodeSelector: {}
tolerations: []
affinity: {}