mirror of
https://github.com/outbackdingo/cozystack.git
synced 2026-02-01 20:08:22 +00:00
Compare commits
12 Commits
proxmox-cs
...
etcd-opera
| Author | SHA1 | Date | |
|---|---|---|---|
|
9efbf5d22e | ||
|
|
662f12e0ce | ||
|
|
3439cf39dd | ||
|
|
965e1be283 | ||
|
|
9145be14c1 | ||
|
|
fca349c641 | ||
|
|
0b38599394 | ||
|
|
0a33950a40 | ||
|
|
e3376a223e | ||
|
|
dee190ad4f | ||
|
|
be508fd107 | ||
|
|
a6d0f7cfd4 |
@@ -63,7 +63,7 @@ spec:
|
||||
serviceAccountName: cozystack
|
||||
containers:
|
||||
- name: cozystack
|
||||
image: "ghcr.io/aenix-io/cozystack/cozystack:v0.3.1"
|
||||
image: "ghcr.io/aenix-io/cozystack/cozystack:v0.4.0"
|
||||
env:
|
||||
- name: KUBERNETES_SERVICE_HOST
|
||||
value: localhost
|
||||
@@ -82,7 +82,7 @@ spec:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: darkhttpd
|
||||
image: "ghcr.io/aenix-io/cozystack/cozystack:v0.3.1"
|
||||
image: "ghcr.io/aenix-io/cozystack/cozystack:v0.4.0"
|
||||
command:
|
||||
- /usr/bin/darkhttpd
|
||||
- /cozystack/assets
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{
|
||||
"containerimage.config.digest": "sha256:e406d5ac59cc06bbab51e16ae9a520143ad4f54952ef8f8cca982dc89454d616",
|
||||
"containerimage.digest": "sha256:08e5063e65d2adc17278abee0ab43ce31cf37bc9bc7eb7988ef16f1f1c459862"
|
||||
"containerimage.config.digest": "sha256:9eb68d2d503d7e22afc6fde2635f566fd3456bbdb3caad5dc9f887be1dc2b8ab",
|
||||
"containerimage.digest": "sha256:1f44274dbc2c3be2a98e6cef83d68a041ae9ef31abb8ab069a525a2a92702bdd"
|
||||
}
|
||||
@@ -1,4 +1,4 @@
|
||||
{
|
||||
"containerimage.config.digest": "sha256:62baab666445d76498fb14cc1d0865fc82e4bdd5cb1d7ba80475dc5024184622",
|
||||
"containerimage.digest": "sha256:9363d717f966f4e7927da332eaaf17401b42203a2fcb493b428f94d096dae3a5"
|
||||
"containerimage.config.digest": "sha256:a7e8e6e35ac07bcf6253c9cfcf21fd3c315bd0653ad0427dd5f0cae95ffd3722",
|
||||
"containerimage.digest": "sha256:c03bffeeb70fe7dd680d2eca3021d2405fbcd9961dd38437f5673560c31c72cc"
|
||||
}
|
||||
@@ -15,6 +15,12 @@ spec:
|
||||
labels:
|
||||
app: {{ .Release.Name }}-cluster-autoscaler
|
||||
spec:
|
||||
tolerations:
|
||||
- key: CriticalAddonsOnly
|
||||
operator: Exists
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
effect: "NoSchedule"
|
||||
containers:
|
||||
- image: ghcr.io/kvaps/test:cluster-autoscaller
|
||||
name: cluster-autoscaler
|
||||
|
||||
@@ -16,12 +16,10 @@ spec:
|
||||
spec:
|
||||
serviceAccountName: {{ .Release.Name }}-kcsi
|
||||
priorityClassName: system-cluster-critical
|
||||
nodeSelector:
|
||||
node-role.kubernetes.io/control-plane: ""
|
||||
tolerations:
|
||||
- key: CriticalAddonsOnly
|
||||
operator: Exists
|
||||
- key: node-role.kubernetes.io/master
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
effect: "NoSchedule"
|
||||
containers:
|
||||
|
||||
@@ -12,6 +12,12 @@ spec:
|
||||
spec:
|
||||
serviceAccountName: {{ .Release.Name }}-flux-teardown
|
||||
restartPolicy: Never
|
||||
tolerations:
|
||||
- key: CriticalAddonsOnly
|
||||
operator: Exists
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
effect: "NoSchedule"
|
||||
containers:
|
||||
- name: kubectl
|
||||
image: docker.io/clastix/kubectl:v1.29.1
|
||||
|
||||
@@ -14,6 +14,12 @@ spec:
|
||||
labels:
|
||||
k8s-app: {{ .Release.Name }}-kccm
|
||||
spec:
|
||||
tolerations:
|
||||
- key: CriticalAddonsOnly
|
||||
operator: Exists
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
effect: "NoSchedule"
|
||||
containers:
|
||||
- name: kubevirt-cloud-controller-manager
|
||||
args:
|
||||
@@ -44,6 +50,4 @@ spec:
|
||||
- secret:
|
||||
secretName: {{ .Release.Name }}-admin-kubeconfig
|
||||
name: kubeconfig
|
||||
tolerations:
|
||||
- operator: Exists
|
||||
serviceAccountName: {{ .Release.Name }}-kccm
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{
|
||||
"containerimage.config.digest": "sha256:29b11ecbb92bae830f2e55cd4b6f7f3ada09b2f5514c0eeee395bd2dbd12fb81",
|
||||
"containerimage.digest": "sha256:791df989ff37a76062c7c638dbfc93435df9ee0db48797f2045c80b6d6b937c0"
|
||||
"containerimage.config.digest": "sha256:aefc3ca9f56f69270d7ce6f56a1ce5b531332d5641481eb54c8e74b66b0f3341",
|
||||
"containerimage.digest": "sha256:a2bf43cb7eb812166edfeb1a4fae6a76a4ddba93be2c0ba9040a804ccb53c261"
|
||||
}
|
||||
@@ -1 +1 @@
|
||||
ghcr.io/aenix-io/cozystack/cozystack:v0.3.1
|
||||
ghcr.io/aenix-io/cozystack/cozystack:v0.4.0
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{
|
||||
"containerimage.config.digest": "sha256:d63ac434876b4e47c130e6b99f0c9657e718f9d97f522f5ccd878eab75844122",
|
||||
"containerimage.digest": "sha256:9963580a02ac4ddccafb60f2411365910bcadd73f92d1c9187a278221306a4ed"
|
||||
"containerimage.config.digest": "sha256:68ea72fcc581352fabfd87fa6fd482968cc85ee520cab7a614f1244d7ae36eb0",
|
||||
"containerimage.digest": "sha256:cea915e08a19eb6892f3facf3b3648368cd4a05abefc49bc2616ba3340c27e82"
|
||||
}
|
||||
@@ -1 +1 @@
|
||||
ghcr.io/aenix-io/cozystack/matchbox:v1.6.4
|
||||
ghcr.io/aenix-io/cozystack/matchbox:v1.7.1
|
||||
|
||||
@@ -3,24 +3,25 @@
|
||||
arch: amd64
|
||||
platform: metal
|
||||
secureboot: false
|
||||
version: v1.6.4
|
||||
version: v1.7.1
|
||||
input:
|
||||
kernel:
|
||||
path: /usr/install/amd64/vmlinuz
|
||||
initramfs:
|
||||
path: /usr/install/amd64/initramfs.xz
|
||||
baseInstaller:
|
||||
imageRef: ghcr.io/siderolabs/installer:v1.6.4
|
||||
imageRef: ghcr.io/siderolabs/installer:v1.7.1
|
||||
systemExtensions:
|
||||
- imageRef: ghcr.io/siderolabs/amd-ucode:20240115
|
||||
- imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240115
|
||||
- imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240115
|
||||
- imageRef: ghcr.io/siderolabs/i915-ucode:20240115
|
||||
- imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240115
|
||||
- imageRef: ghcr.io/siderolabs/intel-ucode:20231114
|
||||
- imageRef: ghcr.io/siderolabs/qlogic-firmware:20240115
|
||||
- imageRef: ghcr.io/siderolabs/drbd:9.2.6-v1.6.4
|
||||
- imageRef: ghcr.io/siderolabs/zfs:2.1.14-v1.6.4
|
||||
- imageRef: ghcr.io/siderolabs/amd-ucode:20240410
|
||||
- imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240410
|
||||
- imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240410
|
||||
- imageRef: ghcr.io/siderolabs/i915-ucode:20240410
|
||||
- imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240410
|
||||
- imageRef: ghcr.io/siderolabs/intel-ucode:20240312
|
||||
- imageRef: ghcr.io/siderolabs/qlogic-firmware:20240410
|
||||
- imageRef: ghcr.io/siderolabs/drbd:9.2.8-v1.7.1
|
||||
- imageRef: ghcr.io/siderolabs/zfs:2.2.3-v1.7.1
|
||||
output:
|
||||
kind: initramfs
|
||||
imageOptions: {}
|
||||
outFormat: raw
|
||||
|
||||
@@ -3,24 +3,25 @@
|
||||
arch: amd64
|
||||
platform: metal
|
||||
secureboot: false
|
||||
version: v1.6.4
|
||||
version: v1.7.1
|
||||
input:
|
||||
kernel:
|
||||
path: /usr/install/amd64/vmlinuz
|
||||
initramfs:
|
||||
path: /usr/install/amd64/initramfs.xz
|
||||
baseInstaller:
|
||||
imageRef: ghcr.io/siderolabs/installer:v1.6.4
|
||||
imageRef: ghcr.io/siderolabs/installer:v1.7.1
|
||||
systemExtensions:
|
||||
- imageRef: ghcr.io/siderolabs/amd-ucode:20240115
|
||||
- imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240115
|
||||
- imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240115
|
||||
- imageRef: ghcr.io/siderolabs/i915-ucode:20240115
|
||||
- imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240115
|
||||
- imageRef: ghcr.io/siderolabs/intel-ucode:20231114
|
||||
- imageRef: ghcr.io/siderolabs/qlogic-firmware:20240115
|
||||
- imageRef: ghcr.io/siderolabs/drbd:9.2.6-v1.6.4
|
||||
- imageRef: ghcr.io/siderolabs/zfs:2.1.14-v1.6.4
|
||||
- imageRef: ghcr.io/siderolabs/amd-ucode:20240410
|
||||
- imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240410
|
||||
- imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240410
|
||||
- imageRef: ghcr.io/siderolabs/i915-ucode:20240410
|
||||
- imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240410
|
||||
- imageRef: ghcr.io/siderolabs/intel-ucode:20240312
|
||||
- imageRef: ghcr.io/siderolabs/qlogic-firmware:20240410
|
||||
- imageRef: ghcr.io/siderolabs/drbd:9.2.8-v1.7.1
|
||||
- imageRef: ghcr.io/siderolabs/zfs:2.2.3-v1.7.1
|
||||
output:
|
||||
kind: installer
|
||||
imageOptions: {}
|
||||
outFormat: raw
|
||||
|
||||
@@ -3,24 +3,25 @@
|
||||
arch: amd64
|
||||
platform: metal
|
||||
secureboot: false
|
||||
version: v1.6.4
|
||||
version: v1.7.1
|
||||
input:
|
||||
kernel:
|
||||
path: /usr/install/amd64/vmlinuz
|
||||
initramfs:
|
||||
path: /usr/install/amd64/initramfs.xz
|
||||
baseInstaller:
|
||||
imageRef: ghcr.io/siderolabs/installer:v1.6.4
|
||||
imageRef: ghcr.io/siderolabs/installer:v1.7.1
|
||||
systemExtensions:
|
||||
- imageRef: ghcr.io/siderolabs/amd-ucode:20240115
|
||||
- imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240115
|
||||
- imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240115
|
||||
- imageRef: ghcr.io/siderolabs/i915-ucode:20240115
|
||||
- imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240115
|
||||
- imageRef: ghcr.io/siderolabs/intel-ucode:20231114
|
||||
- imageRef: ghcr.io/siderolabs/qlogic-firmware:20240115
|
||||
- imageRef: ghcr.io/siderolabs/drbd:9.2.6-v1.6.4
|
||||
- imageRef: ghcr.io/siderolabs/zfs:2.1.14-v1.6.4
|
||||
- imageRef: ghcr.io/siderolabs/amd-ucode:20240410
|
||||
- imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240410
|
||||
- imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240410
|
||||
- imageRef: ghcr.io/siderolabs/i915-ucode:20240410
|
||||
- imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240410
|
||||
- imageRef: ghcr.io/siderolabs/intel-ucode:20240312
|
||||
- imageRef: ghcr.io/siderolabs/qlogic-firmware:20240410
|
||||
- imageRef: ghcr.io/siderolabs/drbd:9.2.8-v1.7.1
|
||||
- imageRef: ghcr.io/siderolabs/zfs:2.2.3-v1.7.1
|
||||
output:
|
||||
kind: iso
|
||||
imageOptions: {}
|
||||
outFormat: raw
|
||||
|
||||
@@ -3,24 +3,25 @@
|
||||
arch: amd64
|
||||
platform: metal
|
||||
secureboot: false
|
||||
version: v1.6.4
|
||||
version: v1.7.1
|
||||
input:
|
||||
kernel:
|
||||
path: /usr/install/amd64/vmlinuz
|
||||
initramfs:
|
||||
path: /usr/install/amd64/initramfs.xz
|
||||
baseInstaller:
|
||||
imageRef: ghcr.io/siderolabs/installer:v1.6.4
|
||||
imageRef: ghcr.io/siderolabs/installer:v1.7.1
|
||||
systemExtensions:
|
||||
- imageRef: ghcr.io/siderolabs/amd-ucode:20240115
|
||||
- imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240115
|
||||
- imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240115
|
||||
- imageRef: ghcr.io/siderolabs/i915-ucode:20240115
|
||||
- imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240115
|
||||
- imageRef: ghcr.io/siderolabs/intel-ucode:20231114
|
||||
- imageRef: ghcr.io/siderolabs/qlogic-firmware:20240115
|
||||
- imageRef: ghcr.io/siderolabs/drbd:9.2.6-v1.6.4
|
||||
- imageRef: ghcr.io/siderolabs/zfs:2.1.14-v1.6.4
|
||||
- imageRef: ghcr.io/siderolabs/amd-ucode:20240410
|
||||
- imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240410
|
||||
- imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240410
|
||||
- imageRef: ghcr.io/siderolabs/i915-ucode:20240410
|
||||
- imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240410
|
||||
- imageRef: ghcr.io/siderolabs/intel-ucode:20240312
|
||||
- imageRef: ghcr.io/siderolabs/qlogic-firmware:20240410
|
||||
- imageRef: ghcr.io/siderolabs/drbd:9.2.8-v1.7.1
|
||||
- imageRef: ghcr.io/siderolabs/zfs:2.2.3-v1.7.1
|
||||
output:
|
||||
kind: kernel
|
||||
imageOptions: {}
|
||||
outFormat: raw
|
||||
|
||||
@@ -3,25 +3,25 @@
|
||||
arch: amd64
|
||||
platform: metal
|
||||
secureboot: false
|
||||
version: v1.6.4
|
||||
version: v1.7.1
|
||||
input:
|
||||
kernel:
|
||||
path: /usr/install/amd64/vmlinuz
|
||||
initramfs:
|
||||
path: /usr/install/amd64/initramfs.xz
|
||||
baseInstaller:
|
||||
imageRef: ghcr.io/siderolabs/installer:v1.6.4
|
||||
imageRef: ghcr.io/siderolabs/installer:v1.7.1
|
||||
systemExtensions:
|
||||
- imageRef: ghcr.io/siderolabs/amd-ucode:20240115
|
||||
- imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240115
|
||||
- imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240115
|
||||
- imageRef: ghcr.io/siderolabs/i915-ucode:20240115
|
||||
- imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240115
|
||||
- imageRef: ghcr.io/siderolabs/intel-ucode:20231114
|
||||
- imageRef: ghcr.io/siderolabs/qlogic-firmware:20240115
|
||||
- imageRef: ghcr.io/siderolabs/drbd:9.2.6-v1.6.4
|
||||
- imageRef: ghcr.io/siderolabs/zfs:2.1.14-v1.6.4
|
||||
- imageRef: ghcr.io/siderolabs/amd-ucode:20240410
|
||||
- imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240410
|
||||
- imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240410
|
||||
- imageRef: ghcr.io/siderolabs/i915-ucode:20240410
|
||||
- imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240410
|
||||
- imageRef: ghcr.io/siderolabs/intel-ucode:20240312
|
||||
- imageRef: ghcr.io/siderolabs/qlogic-firmware:20240410
|
||||
- imageRef: ghcr.io/siderolabs/drbd:9.2.8-v1.7.1
|
||||
- imageRef: ghcr.io/siderolabs/zfs:2.2.3-v1.7.1
|
||||
output:
|
||||
kind: image
|
||||
kind: nocloud
|
||||
imageOptions: { diskSize: 1306525696, diskFormat: raw }
|
||||
outFormat: .xz
|
||||
|
||||
@@ -52,6 +52,12 @@ releases:
|
||||
privileged: true
|
||||
dependsOn: [cilium]
|
||||
|
||||
- name: etcd-operator
|
||||
releaseName: etcd-operator
|
||||
chart: cozy-etcd-operator
|
||||
namespace: cozy-etcd-operator
|
||||
dependsOn: [cilium,cert-manager]
|
||||
|
||||
- name: grafana-operator
|
||||
releaseName: grafana-operator
|
||||
chart: cozy-grafana-operator
|
||||
|
||||
@@ -26,6 +26,12 @@ releases:
|
||||
privileged: true
|
||||
dependsOn: [victoria-metrics-operator]
|
||||
|
||||
- name: etcd-operator
|
||||
releaseName: etcd-operator
|
||||
chart: cozy-etcd-operator
|
||||
namespace: cozy-etcd-operator
|
||||
dependsOn: [cert-manager]
|
||||
|
||||
- name: grafana-operator
|
||||
releaseName: grafana-operator
|
||||
chart: cozy-grafana-operator
|
||||
|
||||
@@ -81,6 +81,12 @@ releases:
|
||||
privileged: true
|
||||
dependsOn: [cilium,kubeovn]
|
||||
|
||||
- name: etcd-operator
|
||||
releaseName: etcd-operator
|
||||
chart: cozy-etcd-operator
|
||||
namespace: cozy-etcd-operator
|
||||
dependsOn: [cilium,kubeovn,cert-manager]
|
||||
|
||||
- name: grafana-operator
|
||||
releaseName: grafana-operator
|
||||
chart: cozy-grafana-operator
|
||||
|
||||
@@ -26,6 +26,12 @@ releases:
|
||||
privileged: true
|
||||
dependsOn: [victoria-metrics-operator]
|
||||
|
||||
- name: etcd-operator
|
||||
releaseName: etcd-operator
|
||||
chart: cozy-etcd-operator
|
||||
namespace: cozy-etcd-operator
|
||||
dependsOn: [cert-manager]
|
||||
|
||||
- name: grafana-operator
|
||||
releaseName: grafana-operator
|
||||
chart: cozy-grafana-operator
|
||||
|
||||
@@ -23,9 +23,11 @@ spec:
|
||||
interval: 1m
|
||||
releaseName: {{ $x.releaseName | default $x.name }}
|
||||
install:
|
||||
crds: CreateReplace
|
||||
remediation:
|
||||
retries: -1
|
||||
upgrade:
|
||||
crds: CreateReplace
|
||||
remediation:
|
||||
retries: -1
|
||||
chart:
|
||||
|
||||
@@ -3,4 +3,4 @@ name: etcd
|
||||
description: Storage for Kubernetes clusters
|
||||
icon: https://www.svgrepo.com/show/353714/etcd.svg
|
||||
type: application
|
||||
version: 1.0.0
|
||||
version: 2.0.0
|
||||
|
||||
50
packages/extra/etcd/templates/datastore.yaml
Normal file
50
packages/extra/etcd/templates/datastore.yaml
Normal file
@@ -0,0 +1,50 @@
|
||||
---
|
||||
apiVersion: kamaji.clastix.io/v1alpha1
|
||||
kind: DataStore
|
||||
metadata:
|
||||
name: {{ .Release.Namespace }}
|
||||
spec:
|
||||
driver: etcd
|
||||
endpoints:
|
||||
- etcd-0.etcd-headless.{{ .Release.Namespace }}.svc:2379
|
||||
- etcd-1.etcd-headless.{{ .Release.Namespace }}.svc:2379
|
||||
- etcd-2.etcd-headless.{{ .Release.Namespace }}.svc:2379
|
||||
tlsConfig:
|
||||
certificateAuthority:
|
||||
certificate:
|
||||
secretReference:
|
||||
keyPath: tls.crt
|
||||
name: etcd-ca-tls
|
||||
namespace: {{ .Release.Namespace }}
|
||||
privateKey:
|
||||
secretReference:
|
||||
keyPath: tls.key
|
||||
name: etcd-ca-tls
|
||||
namespace: {{ .Release.Namespace }}
|
||||
clientCertificate:
|
||||
certificate:
|
||||
secretReference:
|
||||
keyPath: tls.crt
|
||||
name: etcd-client-tls
|
||||
namespace: {{ .Release.Namespace }}
|
||||
privateKey:
|
||||
secretReference:
|
||||
keyPath: tls.key
|
||||
name: etcd-client-tls
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: etcd-ca-tls
|
||||
annotations:
|
||||
helm.sh/hook: pre-install
|
||||
helm.sh/resource-policy: keep
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: etcd-client-tls
|
||||
annotations:
|
||||
helm.sh/hook: pre-install
|
||||
helm.sh/resource-policy: keep
|
||||
176
packages/extra/etcd/templates/etcd-cluster.yaml
Normal file
176
packages/extra/etcd/templates/etcd-cluster.yaml
Normal file
@@ -0,0 +1,176 @@
|
||||
---
|
||||
apiVersion: etcd.aenix.io/v1alpha1
|
||||
kind: EtcdCluster
|
||||
metadata:
|
||||
name: etcd
|
||||
spec:
|
||||
storage: {}
|
||||
security:
|
||||
tls:
|
||||
peerTrustedCASecret: etcd-peer-ca-tls
|
||||
peerSecret: etcd-peer-tls
|
||||
serverSecret: etcd-server-tls
|
||||
clientTrustedCASecret: etcd-ca-tls
|
||||
clientSecret: etcd-client-tls
|
||||
podTemplate:
|
||||
spec:
|
||||
topologySpreadConstraints:
|
||||
- maxSkew: 1
|
||||
topologyKey: "kubernetes.io/hostname"
|
||||
whenUnsatisfiable: ScheduleAnyway
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: etcd
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Issuer
|
||||
metadata:
|
||||
name: etcd-selfsigning-issuer
|
||||
spec:
|
||||
selfSigned: {}
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: etcd-peer-ca
|
||||
spec:
|
||||
isCA: true
|
||||
usages:
|
||||
- "signing"
|
||||
- "key encipherment"
|
||||
- "cert sign"
|
||||
commonName: etcd-peer-ca
|
||||
subject:
|
||||
organizations:
|
||||
- ACME Inc.
|
||||
organizationalUnits:
|
||||
- Widgets
|
||||
secretName: etcd-peer-ca-tls
|
||||
privateKey:
|
||||
algorithm: RSA
|
||||
size: 4096
|
||||
issuerRef:
|
||||
name: etcd-selfsigning-issuer
|
||||
kind: Issuer
|
||||
group: cert-manager.io
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: etcd-ca
|
||||
spec:
|
||||
isCA: true
|
||||
usages:
|
||||
- "signing"
|
||||
- "key encipherment"
|
||||
- "cert sign"
|
||||
commonName: etcd-ca
|
||||
subject:
|
||||
organizations:
|
||||
- ACME Inc.
|
||||
organizationalUnits:
|
||||
- Widgets
|
||||
secretName: etcd-ca-tls
|
||||
privateKey:
|
||||
algorithm: RSA
|
||||
size: 4096
|
||||
issuerRef:
|
||||
name: etcd-selfsigning-issuer
|
||||
kind: Issuer
|
||||
group: cert-manager.io
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Issuer
|
||||
metadata:
|
||||
name: etcd-peer-issuer
|
||||
spec:
|
||||
ca:
|
||||
secretName: etcd-peer-ca-tls
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Issuer
|
||||
metadata:
|
||||
name: etcd-issuer
|
||||
spec:
|
||||
ca:
|
||||
secretName: etcd-ca-tls
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: etcd-server
|
||||
spec:
|
||||
secretName: etcd-server-tls
|
||||
isCA: false
|
||||
usages:
|
||||
- "server auth"
|
||||
- "signing"
|
||||
- "key encipherment"
|
||||
dnsNames:
|
||||
- etcd-0
|
||||
- etcd-0.etcd-headless
|
||||
- etcd-0.etcd-headless.{{ .Release.Namespace }}.svc
|
||||
- etcd-1
|
||||
- etcd-1.etcd-headless
|
||||
- etcd-1.etcd-headless.{{ .Release.Namespace }}.svc
|
||||
- etcd-2
|
||||
- etcd-2.etcd-headless
|
||||
- etcd-2.etcd-headless.{{ .Release.Namespace }}.svc
|
||||
- localhost
|
||||
- "127.0.0.1"
|
||||
privateKey:
|
||||
rotationPolicy: Always
|
||||
algorithm: RSA
|
||||
size: 4096
|
||||
issuerRef:
|
||||
name: etcd-issuer
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: etcd-peer
|
||||
spec:
|
||||
secretName: etcd-peer-tls
|
||||
isCA: false
|
||||
usages:
|
||||
- "server auth"
|
||||
- "client auth"
|
||||
- "signing"
|
||||
- "key encipherment"
|
||||
dnsNames:
|
||||
- etcd-0
|
||||
- etcd-0.etcd-headless
|
||||
- etcd-0.etcd-headless.{{ .Release.Namespace }}.svc
|
||||
- etcd-1
|
||||
- etcd-1.etcd-headless
|
||||
- etcd-1.etcd-headless.{{ .Release.Namespace }}.svc
|
||||
- etcd-2
|
||||
- etcd-2.etcd-headless
|
||||
- etcd-2.etcd-headless.{{ .Release.Namespace }}.svc
|
||||
- localhost
|
||||
- "127.0.0.1"
|
||||
privateKey:
|
||||
rotationPolicy: Always
|
||||
algorithm: RSA
|
||||
size: 4096
|
||||
issuerRef:
|
||||
name: etcd-peer-issuer
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: etcd-client
|
||||
spec:
|
||||
commonName: root
|
||||
secretName: etcd-client-tls
|
||||
usages:
|
||||
- "signing"
|
||||
- "key encipherment"
|
||||
- "client auth"
|
||||
privateKey:
|
||||
rotationPolicy: Always
|
||||
algorithm: RSA
|
||||
size: 4096
|
||||
issuerRef:
|
||||
name: etcd-issuer
|
||||
kind: Issuer
|
||||
@@ -1,19 +0,0 @@
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: kamaji-etcd
|
||||
spec:
|
||||
chart:
|
||||
spec:
|
||||
chart: cozy-kamaji-etcd
|
||||
reconcileStrategy: Revision
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: cozystack-system
|
||||
namespace: cozy-system
|
||||
version: '*'
|
||||
interval: 1m0s
|
||||
timeout: 5m0s
|
||||
values:
|
||||
kamaji-etcd:
|
||||
fullnameOverride: etcd
|
||||
@@ -1,3 +1,4 @@
|
||||
etcd 1.0.0 HEAD
|
||||
etcd 1.0.0 f7eaab0
|
||||
etcd 2.0.0 HEAD
|
||||
ingress 1.0.0 HEAD
|
||||
monitoring 1.0.0 HEAD
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{
|
||||
"containerimage.config.digest": "sha256:ac9429d9bf66dd913a37fa9c22a6a2ccdc5d6bef50986bfef7868b5643ecaab2",
|
||||
"containerimage.digest": "sha256:b551704d07e93f9837d36bb610ae5d10508325c31e9bd98a019452eed12ed96f"
|
||||
"containerimage.config.digest": "sha256:78b413d1c9a4ecf3bec9383444b3e85c01d8b33bf903c6443bfa5bdfd8b5bc04",
|
||||
"containerimage.digest": "sha256:ddfaadb33e33123f553a36a3ee5857a1bf53f312043f91d76ad24316591fd26e"
|
||||
}
|
||||
@@ -1 +1 @@
|
||||
ghcr.io/aenix-io/cozystack/dashboard:latest
|
||||
ghcr.io/aenix-io/cozystack/dashboard:v0.4.0
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{
|
||||
"containerimage.config.digest": "sha256:ab059b6397905b2a2084def06582e61b49c4a8a3374747e87b08c82621357420",
|
||||
"containerimage.digest": "sha256:9c1093da42482f116b27407edcdf8b24122885e295cbb632e565213c66fc07c0"
|
||||
"containerimage.config.digest": "sha256:273a8e7055816068b2975d8ac10f0f7d114cafef74057680ffc60414d4d8cf4c",
|
||||
"containerimage.digest": "sha256:5e111f09ee9c34281e2ef02cb0d41700943f8c036014110765bb002831148547"
|
||||
}
|
||||
@@ -1 +1 @@
|
||||
ghcr.io/aenix-io/cozystack/kubeapps-apis:latest
|
||||
ghcr.io/aenix-io/cozystack/kubeapps-apis:v0.4.0
|
||||
|
||||
3
packages/system/etcd-operator/.helmignore
Normal file
3
packages/system/etcd-operator/.helmignore
Normal file
@@ -0,0 +1,3 @@
|
||||
images
|
||||
hack
|
||||
.gitkeep
|
||||
2
packages/system/etcd-operator/Chart.yaml
Normal file
2
packages/system/etcd-operator/Chart.yaml
Normal file
@@ -0,0 +1,2 @@
|
||||
name: cozy-etcd-operator
|
||||
version: 0.4.0
|
||||
8
packages/system/etcd-operator/Makefile
Normal file
8
packages/system/etcd-operator/Makefile
Normal file
@@ -0,0 +1,8 @@
|
||||
NAME=etcd-operator
|
||||
NAMESPACE=cozy-${NAME}
|
||||
|
||||
include ../../../scripts/package-system.mk
|
||||
|
||||
update:
|
||||
rm -rf charts
|
||||
helm pull oci://ghcr.io/aenix-io/charts/etcd-operator --untar --untardir charts
|
||||
@@ -0,0 +1,23 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
@@ -0,0 +1,5 @@
|
||||
apiVersion: v2
|
||||
appVersion: v0.2.0
|
||||
name: etcd-operator
|
||||
type: application
|
||||
version: 0.2.0
|
||||
63
packages/system/etcd-operator/charts/etcd-operator/README.md
Normal file
63
packages/system/etcd-operator/charts/etcd-operator/README.md
Normal file
@@ -0,0 +1,63 @@
|
||||
# etcd-operator
|
||||
|
||||
  
|
||||
|
||||
## Values
|
||||
|
||||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| affinity | object | `{}` | |
|
||||
| etcdOperator.args[0] | string | `"--health-probe-bind-address=:8081"` | |
|
||||
| etcdOperator.args[1] | string | `"--metrics-bind-address=127.0.0.1:8080"` | |
|
||||
| etcdOperator.args[2] | string | `"--leader-elect"` | |
|
||||
| etcdOperator.envVars | object | `{}` | |
|
||||
| etcdOperator.image.pullPolicy | string | `"IfNotPresent"` | |
|
||||
| etcdOperator.image.repository | string | `"ghcr.io/aenix-io/etcd-operator"` | |
|
||||
| etcdOperator.image.tag | string | `""` | |
|
||||
| etcdOperator.livenessProbe.httpGet.path | string | `"/healthz"` | |
|
||||
| etcdOperator.livenessProbe.httpGet.port | int | `8081` | |
|
||||
| etcdOperator.livenessProbe.initialDelaySeconds | int | `15` | |
|
||||
| etcdOperator.livenessProbe.periodSeconds | int | `20` | |
|
||||
| etcdOperator.readinessProbe.httpGet.path | string | `"/readyz"` | |
|
||||
| etcdOperator.readinessProbe.httpGet.port | int | `8081` | |
|
||||
| etcdOperator.readinessProbe.initialDelaySeconds | int | `5` | |
|
||||
| etcdOperator.readinessProbe.periodSeconds | int | `10` | |
|
||||
| etcdOperator.resources.limits.cpu | string | `"500m"` | |
|
||||
| etcdOperator.resources.limits.memory | string | `"128Mi"` | |
|
||||
| etcdOperator.resources.requests.cpu | string | `"100m"` | |
|
||||
| etcdOperator.resources.requests.memory | string | `"64Mi"` | |
|
||||
| etcdOperator.securityContext.allowPrivilegeEscalation | bool | `false` | |
|
||||
| etcdOperator.securityContext.capabilities.drop[0] | string | `"ALL"` | |
|
||||
| etcdOperator.service.port | int | `9443` | |
|
||||
| etcdOperator.service.type | string | `"ClusterIP"` | |
|
||||
| fullnameOverride | string | `""` | |
|
||||
| imagePullSecrets | list | `[]` | |
|
||||
| kubeRbacProxy.args[0] | string | `"--secure-listen-address=0.0.0.0:8443"` | |
|
||||
| kubeRbacProxy.args[1] | string | `"--upstream=http://127.0.0.1:8080/"` | |
|
||||
| kubeRbacProxy.args[2] | string | `"--logtostderr=true"` | |
|
||||
| kubeRbacProxy.args[3] | string | `"--v=0"` | |
|
||||
| kubeRbacProxy.image.pullPolicy | string | `"IfNotPresent"` | |
|
||||
| kubeRbacProxy.image.repository | string | `"gcr.io/kubebuilder/kube-rbac-proxy"` | |
|
||||
| kubeRbacProxy.image.tag | string | `"v0.16.0"` | |
|
||||
| kubeRbacProxy.livenessProbe | object | `{}` | |
|
||||
| kubeRbacProxy.readinessProbe | object | `{}` | |
|
||||
| kubeRbacProxy.resources.limits.cpu | string | `"500m"` | |
|
||||
| kubeRbacProxy.resources.limits.memory | string | `"128Mi"` | |
|
||||
| kubeRbacProxy.resources.requests.cpu | string | `"100m"` | |
|
||||
| kubeRbacProxy.resources.requests.memory | string | `"64Mi"` | |
|
||||
| kubeRbacProxy.securityContext.allowPrivilegeEscalation | bool | `false` | |
|
||||
| kubeRbacProxy.securityContext.capabilities.drop[0] | string | `"ALL"` | |
|
||||
| kubeRbacProxy.service.port | int | `8443` | |
|
||||
| kubeRbacProxy.service.type | string | `"ClusterIP"` | |
|
||||
| kubernetesClusterDomain | string | `"cluster.local"` | |
|
||||
| nameOverride | string | `""` | |
|
||||
| nodeSelector | object | `{}` | |
|
||||
| podAnnotations | object | `{}` | |
|
||||
| podLabels | object | `{}` | |
|
||||
| podSecurityContext | object | `{}` | |
|
||||
| replicaCount | int | `1` | |
|
||||
| securityContext.runAsNonRoot | bool | `true` | |
|
||||
| serviceAccount.annotations | object | `{}` | |
|
||||
| serviceAccount.create | bool | `true` | |
|
||||
| tolerations | list | `[]` | |
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,51 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "etcd-operator.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "etcd-operator.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "etcd-operator.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "etcd-operator.labels" -}}
|
||||
helm.sh/chart: {{ include "etcd-operator.chart" . }}
|
||||
{{ include "etcd-operator.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "etcd-operator.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "etcd-operator.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
name: {{ include "etcd-operator.fullname" . }}-serving-cert
|
||||
spec:
|
||||
dnsNames:
|
||||
- {{ include "etcd-operator.fullname" . }}-webhook-service.{{ .Release.Namespace }}.svc
|
||||
- {{ include "etcd-operator.fullname" . }}-webhook-service.{{ .Release.Namespace }}.svc.{{ .Values.kubernetesClusterDomain }}
|
||||
issuerRef:
|
||||
kind: Issuer
|
||||
name: {{ include "etcd-operator.fullname" . }}-selfsigned-issuer
|
||||
secretName: webhook-server-cert
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Issuer
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
name: {{ include "etcd-operator.fullname" . }}-selfsigned-issuer
|
||||
spec:
|
||||
selfSigned: {}
|
||||
@@ -0,0 +1,29 @@
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: MutatingWebhookConfiguration
|
||||
metadata:
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "etcd-operator.fullname" . }}-serving-cert
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
name: {{ include "etcd-operator.fullname" . }}-mutating-webhook-configuration
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
service:
|
||||
name: {{ include "etcd-operator.fullname" . }}-webhook-service
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /mutate-etcd-aenix-io-v1alpha1-etcdcluster
|
||||
failurePolicy: Fail
|
||||
name: metcdcluster.kb.io
|
||||
rules:
|
||||
- apiGroups:
|
||||
- etcd.aenix.io
|
||||
apiVersions:
|
||||
- v1alpha1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- etcdclusters
|
||||
sideEffects: None
|
||||
@@ -0,0 +1,29 @@
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "etcd-operator.fullname" . }}-serving-cert
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
name: {{ include "etcd-operator.fullname" . }}-validating-webhook-configuration
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
service:
|
||||
name: {{ include "etcd-operator.fullname" . }}-webhook-service
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-etcd-aenix-io-v1alpha1-etcdcluster
|
||||
failurePolicy: Fail
|
||||
name: vetcdcluster.kb.io
|
||||
rules:
|
||||
- apiGroups:
|
||||
- etcd.aenix.io
|
||||
apiVersions:
|
||||
- v1alpha1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- etcdclusters
|
||||
sideEffects: None
|
||||
@@ -0,0 +1,81 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
name: {{ include "etcd-operator.fullname" . }}-manager-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- statefulsets
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- etcd.aenix.io
|
||||
resources:
|
||||
- etcdclusters
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- etcd.aenix.io
|
||||
resources:
|
||||
- etcdclusters/finalizers
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- etcd.aenix.io
|
||||
resources:
|
||||
- etcdclusters/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- policy
|
||||
resources:
|
||||
- poddisruptionbudgets
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
@@ -0,0 +1,11 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
name: {{ include "etcd-operator.fullname" . }}-metrics-reader
|
||||
rules:
|
||||
- nonResourceURLs:
|
||||
- /metrics
|
||||
verbs:
|
||||
- get
|
||||
@@ -0,0 +1,19 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
name: {{ include "etcd-operator.fullname" . }}-proxy-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- authentication.k8s.io
|
||||
resources:
|
||||
- tokenreviews
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- authorization.k8s.io
|
||||
resources:
|
||||
- subjectaccessreviews
|
||||
verbs:
|
||||
- create
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
name: {{ include "etcd-operator.fullname" . }}-manager-rolebinding
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "etcd-operator.fullname" . }}-manager-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "etcd-operator.fullname" . }}-controller-manager
|
||||
namespace: {{ .Release.Namespace }}
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
name: {{ include "etcd-operator.fullname" . }}-proxy-rolebinding
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "etcd-operator.fullname" . }}-proxy-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "etcd-operator.fullname" . }}-controller-manager
|
||||
namespace: {{ .Release.Namespace }}
|
||||
@@ -0,0 +1,38 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
name: {{ include "etcd-operator.fullname" . }}-leader-election-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
name: {{ include "etcd-operator.fullname" . }}-leader-election-rolebinding
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ include "etcd-operator.fullname" . }}-leader-election-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "etcd-operator.fullname" . }}-controller-manager
|
||||
namespace: {{ .Release.Namespace }}
|
||||
@@ -0,0 +1,16 @@
|
||||
{{- if .Values.etcdOperator.envVars }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "etcd-operator.labels" . }}-env
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
data:
|
||||
{{- range $k, $v := .Values.etcdOperator.envVars }}
|
||||
{{- if typeOf $v | eq "string" }}
|
||||
{{- print (tpl $k $) ": " (tpl $v $ | quote) | nindent 2 }}
|
||||
{{- else }}
|
||||
{{- print (tpl $k $) ": " ($v | quote) | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,114 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "etcd-operator.fullname" . }}-controller-manager
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "etcd-operator.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
{{- with .Values.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 8 }}
|
||||
{{- with .Values.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: etcd-operator
|
||||
image: {{ .Values.etcdOperator.image.repository }}:{{ .Values.etcdOperator.image.tag | default .Chart.AppVersion }}
|
||||
imagePullPolicy: {{ .Values.etcdOperator.image.pullPolicy }}
|
||||
{{- with .Values.etcdOperator.args }}
|
||||
args:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.etcdOperator.service.port }}
|
||||
name: webhook-server
|
||||
protocol: TCP
|
||||
{{- with .Values.etcdOperator.livenessProbe }}
|
||||
livenessProbe:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.etcdOperator.readinessProbe }}
|
||||
readinessProbe:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.etcdOperator.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.etcdOperator.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.etcdOperator.envVars }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: {{ include "etcd-operator.fullname" . }}-env
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- mountPath: /tmp/k8s-webhook-server/serving-certs
|
||||
name: cert
|
||||
readOnly: true
|
||||
- name: kube-rbac-proxy
|
||||
image: {{ .Values.kubeRbacProxy.image.repository }}:{{ .Values.kubeRbacProxy.image.tag }}
|
||||
imagePullPolicy: {{ .Values.kubeRbacProxy.image.pullPolicy }}
|
||||
{{- with .Values.kubeRbacProxy.args }}
|
||||
args:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.kubeRbacProxy.service.port }}
|
||||
name: https
|
||||
protocol: TCP
|
||||
{{- with .Values.kubeRbacProxy.livenessProbe }}
|
||||
livenessProbe:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kubeRbacProxy.readinessProbe }}
|
||||
readinessProbe:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kubeRbacProxy.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kubeRbacProxy.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.podSecurityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "etcd-operator.fullname" . }}-controller-manager
|
||||
terminationGracePeriodSeconds: 10
|
||||
volumes:
|
||||
- name: cert
|
||||
secret:
|
||||
defaultMode: 420
|
||||
secretName: webhook-server-cert
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "etcd-operator.fullname" . }}-controller-manager-metrics-service
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
spec:
|
||||
type: {{ .Values.kubeRbacProxy.service.type }}
|
||||
ports:
|
||||
- name: https
|
||||
port: {{ .Values.kubeRbacProxy.service.port }}
|
||||
protocol: TCP
|
||||
targetPort: https
|
||||
selector:
|
||||
{{- include "etcd-operator.selectorLabels" . | nindent 4 }}
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
name: {{ include "etcd-operator.fullname" . }}-webhook-service
|
||||
spec:
|
||||
type: {{ .Values.etcdOperator.service.type }}
|
||||
ports:
|
||||
- port: 443
|
||||
protocol: TCP
|
||||
targetPort: {{ .Values.etcdOperator.service.port }}
|
||||
selector:
|
||||
{{- include "etcd-operator.selectorLabels" . | nindent 4 }}
|
||||
@@ -0,0 +1,12 @@
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "etcd-operator.fullname" . }}-controller-manager
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,284 @@
|
||||
{
|
||||
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
||||
"properties": {
|
||||
"affinity": {
|
||||
"properties": {},
|
||||
"type": "object"
|
||||
},
|
||||
"etcdOperator": {
|
||||
"properties": {
|
||||
"args": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"envVars": {
|
||||
"properties": {},
|
||||
"type": "object"
|
||||
},
|
||||
"image": {
|
||||
"properties": {
|
||||
"pullPolicy": {
|
||||
"type": "string"
|
||||
},
|
||||
"repository": {
|
||||
"type": "string"
|
||||
},
|
||||
"tag": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"livenessProbe": {
|
||||
"properties": {
|
||||
"httpGet": {
|
||||
"properties": {
|
||||
"path": {
|
||||
"type": "string"
|
||||
},
|
||||
"port": {
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"initialDelaySeconds": {
|
||||
"type": "integer"
|
||||
},
|
||||
"periodSeconds": {
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"readinessProbe": {
|
||||
"properties": {
|
||||
"httpGet": {
|
||||
"properties": {
|
||||
"path": {
|
||||
"type": "string"
|
||||
},
|
||||
"port": {
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"initialDelaySeconds": {
|
||||
"type": "integer"
|
||||
},
|
||||
"periodSeconds": {
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"resources": {
|
||||
"properties": {
|
||||
"limits": {
|
||||
"properties": {
|
||||
"cpu": {
|
||||
"type": "string"
|
||||
},
|
||||
"memory": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"requests": {
|
||||
"properties": {
|
||||
"cpu": {
|
||||
"type": "string"
|
||||
},
|
||||
"memory": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"securityContext": {
|
||||
"properties": {
|
||||
"allowPrivilegeEscalation": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"capabilities": {
|
||||
"properties": {
|
||||
"drop": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"service": {
|
||||
"properties": {
|
||||
"port": {
|
||||
"type": "integer"
|
||||
},
|
||||
"type": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"fullnameOverride": {
|
||||
"type": "string"
|
||||
},
|
||||
"imagePullSecrets": {
|
||||
"type": "array"
|
||||
},
|
||||
"kubeRbacProxy": {
|
||||
"properties": {
|
||||
"args": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"image": {
|
||||
"properties": {
|
||||
"pullPolicy": {
|
||||
"type": "string"
|
||||
},
|
||||
"repository": {
|
||||
"type": "string"
|
||||
},
|
||||
"tag": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"livenessProbe": {
|
||||
"properties": {},
|
||||
"type": "object"
|
||||
},
|
||||
"readinessProbe": {
|
||||
"properties": {},
|
||||
"type": "object"
|
||||
},
|
||||
"resources": {
|
||||
"properties": {
|
||||
"limits": {
|
||||
"properties": {
|
||||
"cpu": {
|
||||
"type": "string"
|
||||
},
|
||||
"memory": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"requests": {
|
||||
"properties": {
|
||||
"cpu": {
|
||||
"type": "string"
|
||||
},
|
||||
"memory": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"securityContext": {
|
||||
"properties": {
|
||||
"allowPrivilegeEscalation": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"capabilities": {
|
||||
"properties": {
|
||||
"drop": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"service": {
|
||||
"properties": {
|
||||
"port": {
|
||||
"type": "integer"
|
||||
},
|
||||
"type": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"kubernetesClusterDomain": {
|
||||
"type": "string"
|
||||
},
|
||||
"nameOverride": {
|
||||
"type": "string"
|
||||
},
|
||||
"nodeSelector": {
|
||||
"properties": {},
|
||||
"type": "object"
|
||||
},
|
||||
"podAnnotations": {
|
||||
"properties": {},
|
||||
"type": "object"
|
||||
},
|
||||
"podLabels": {
|
||||
"properties": {},
|
||||
"type": "object"
|
||||
},
|
||||
"podSecurityContext": {
|
||||
"properties": {},
|
||||
"type": "object"
|
||||
},
|
||||
"replicaCount": {
|
||||
"type": "integer"
|
||||
},
|
||||
"securityContext": {
|
||||
"properties": {
|
||||
"runAsNonRoot": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"serviceAccount": {
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"properties": {},
|
||||
"type": "object"
|
||||
},
|
||||
"create": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"tolerations": {
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,98 @@
|
||||
etcdOperator:
|
||||
image:
|
||||
repository: ghcr.io/aenix-io/etcd-operator
|
||||
pullPolicy: IfNotPresent
|
||||
# Overrides the image tag whose default is the chart appVersion.
|
||||
tag: ""
|
||||
args:
|
||||
- --health-probe-bind-address=:8081
|
||||
- --metrics-bind-address=127.0.0.1:8080
|
||||
- --leader-elect
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 9443
|
||||
envVars: {}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8081
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 20
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: 8081
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 64Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
|
||||
kubeRbacProxy:
|
||||
image:
|
||||
repository: gcr.io/kubebuilder/kube-rbac-proxy
|
||||
pullPolicy: IfNotPresent
|
||||
tag: v0.16.0
|
||||
args:
|
||||
- --secure-listen-address=0.0.0.0:8443
|
||||
- --upstream=http://127.0.0.1:8080/
|
||||
- --logtostderr=true
|
||||
- --v=0
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 8443
|
||||
livenessProbe: {}
|
||||
readinessProbe: {}
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 64Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
|
||||
kubernetesClusterDomain: cluster.local
|
||||
|
||||
replicaCount: 1
|
||||
|
||||
imagePullSecrets: []
|
||||
|
||||
nameOverride: ""
|
||||
|
||||
fullnameOverride: ""
|
||||
|
||||
serviceAccount:
|
||||
# Specifies whether a service account should be created
|
||||
create: true
|
||||
# Annotations to add to the service account
|
||||
annotations: {}
|
||||
|
||||
podAnnotations: {}
|
||||
|
||||
podLabels: {}
|
||||
|
||||
podSecurityContext: {}
|
||||
# fsGroup: 2000
|
||||
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
|
||||
nodeSelector: {}
|
||||
|
||||
tolerations: []
|
||||
|
||||
affinity: {}
|
||||
Reference in New Issue
Block a user